PRETORIA – Basic Education Minister Siviwe Gwarube has revealed that a Department of Basic Education official whose child was a 2025 National Senior Certificate candidate is allegedly behind the examination leak that has affected 40 pupils in the Tshwane area.
The minister briefed the public on Thursday on interim findings from the National Investigation Task Team (NITT), which investigated the breach involving 2025 NSC examination materials. Despite the breach, examination authority Umalusi approved the 2025 NSC results and confirmed the credibility of the examinations.
Investigation expands from initial findings
The breach was first detected in December during the marking of English Paper 2, when markers identified irregularities that triggered an immediate investigation. Initially, the department reported that 26 learners across seven Pretoria schools were affected, with two officials suspended.
However, the NITT’s comprehensive investigation has since expanded the scope, identifying 40 candidates in the broader Tshwane area and confirming the involvement of at least one official whose child was among the 2025 NSC candidates.
ALSO READ: Department of Basic Education suspends two officials, Umalusi says learners’ results unaffected
“Umalusi’s approval today is a clear assurance to every candidate and every parent: the 2025 NSC remains credible,” Gwarube said. “Where wrongdoing is proven, it will be addressed firmly – but we will not allow a small number of offenders to taint the achievements of the overwhelming majority.”
Breach originated within secure environment
The NITT, chaired by Professor Chika Sehoole and deputy chair Brian Schreuder, found that the breach originated within the DBE’s secure national examinations environment where NSC question papers are set, processed and managed.
The investigation revealed that the suspected DBE official’s child subsequently became part of the distribution chain for the leaked materials. A possible second suspected official remains subject to ongoing forensic investigation, with the department having suspended suspected officials since the breach was discovered in December.
However, the task team emphasised that confirming the exact extraction pathway remains part of continuing forensic work, as investigators have not yet found definitive evidence pinpointing the specific machine and time of extraction from the secure DBE server.
Expanded scope of leaked materials
The investigation has confirmed seven leaked question papers, covering English Home Language (Papers 1, 2 and 3), Mathematics (Papers 1 and 2), and Physical Sciences (Papers 1 and 2). This represents an expansion from the initial three subjects identified when the breach was first detected.
The leaked materials were distributed through multiple methods, including USB drives as initially suspected, but also electronic messaging, screenshots and printed copies, showing a more sophisticated distribution network than first thought.
Despite the expanded scope, the breach remains contained to 40 candidates in the Tshwane area, representing a tiny fraction of the more than 900,000 candidates who wrote the NSC examinations in 2025.
Results withheld pending hearings
Results for the 40 implicated candidates will be withheld temporarily whilst official irregularity processes are completed. Each candidate will be subjected to an independent hearing.
Candidates found guilty may have their results in the relevant subjects nullified and face sanctions including being barred from writing NSC examinations for up to three examination sessions.
The matter was reported to the South African Police Service for criminal investigation in December, with the department implementing disciplinary proceedings against the suspended officials.
The department is also strengthening examination security measures, including tighter controls for handling examination papers, enhanced high-risk centre monitoring, and updated controls to address evolving technology risks including artificial intelligence-enabled tactics.
Data security improvements
Following the 2024 EduMarks incident where candidate data was unlawfully traded, the DBE has implemented stronger security measures for results distribution. Universities and media will only receive 2025 results under embargo 24 hours before official release.
“South Africa can have confidence that the NSC system remains credible: irregularities are detected, investigated with rigour and addressed through firm consequence management – whilst protecting the integrity of the qualification for the overwhelming majority of honest learners,” Gwarube concluded.
