PRETORIA – The Department of Basic Education (DBE) is reeling after a forensic investigation confirmed that the source of the 2025 National Senior Certificate (NSC) exam leak was not an external breach, but an inside job — allegedly orchestrated by a Human Resources official who put her own child’s success ahead of the integrity of South Africa’s education system.
While early reports focused on a single suspect, Basic Education Minister Siviwe Gwarube has now confirmed that two DBE officials have been suspended with immediate effect and are facing a “double-barrelled” onslaught of disciplinary action and criminal prosecution.
At the centre of the scandal is a senior HR professional — a custodian of ethics, conduct and internal controls — accused of abusing her clearance to access and distribute seven high-stakes matric papers, including Mathematics and Physical Sciences. Investigators say she handed the material to her son, a Grade 12 learner, who became a primary distributor among at least 40 pupils across seven Pretoria schools.
The second suspect is a colleague from the DBE’s secure national examinations unit — the very environment where NSC papers are set, processed and guarded. Authorities believe this official enabled the physical or digital extraction of the papers from the department’s most protected systems.
Both officials have been placed on precautionary suspension. The matter has been formally referred to the South African Police Service (SAPS).
A Failure of Professional Ethics
The most jarring revelation in the National Investigative Task Team (NITT) report is the profile of the primary suspect: a senior HR official. As a professional entrusted with upholding ethical standards, confidentiality and internal discipline, she occupied one of the department’s most sensitive positions.
According to investigators, she used her access to obtain a USB drive containing seven exam papers:
- English Home Language (Papers 1–3)
- Mathematics (Papers 1–2)
- Physical Sciences (Papers 1–2)
In what the DBE has described as a “gross betrayal”, she allegedly passed the material to her son, who then circulated it to classmates and peers.
“As an HR professional, this individual was the custodian of the department’s ethics,” a department spokesperson said.
“To orchestrate a breach of this magnitude is not just a lapse in judgment — it is a calculated strike against the credibility of every matriculant in South Africa.”
For parents and educators, the sense of betrayal runs deeper than the leak itself. An HR official is expected to model integrity. Instead, investigators say, that trust was weaponised for personal gain.
The “Inside Man”
While the HR official is accused of distribution, the second suspended staff member is believed to be the source within the examinations unit — the “inside man” who bypassed layers of security in a high-risk environment where question papers are encrypted, stored and tracked.
This follows earlier confirmation that the breach drew in seven Pretoria schools. The Department has declined to publicly name these schools, stating that culpability lies with individuals rather than institutions, to avoid unfairly stigmatizing learners and educators who played no role in the breach.
What is clear is that the breach did not originate in a school, a print room, or a courier chain — it began inside the DBE’s own vault.
How They Were Caught
The collapse of the scheme began not with a tip-off, but with the vigilance of exam markers. On December 2, 2025, markers in Gauteng noticed something deeply unusual in an English Home Language Paper 2 script. The learner had not merely answered correctly — the response mirrored the internal marking guideline, including phrasing and structure intended only for markers. The answers were “too perfect”.
That anomaly triggered a cascade:
- Investigative marking re-examined scripts for identical phrasing, verbatim guideline reproduction, and patterns inconsistent with genuine understanding.
- Statistical analysis revealed clusters of anomalous results across specific schools and subjects.
- Forensic digital audits traced file movement and access logs, linking leaked material to devices inside DBE offices.
- USB tracking confirmed the papers were transferred via removable storage.
- Learner interviews led investigators directly to the HR official’s son.
From there, the distribution chain became clear. Material spread through USBs, WhatsApp messages, screenshots and printed copies. Some learners reportedly used AI tools to structure answers based on leaked marking guidelines.
In total, 40 learners across seven Tshwane schools were implicated. Their results have been withheld following Umalusi’s decision to cancel and freeze outcomes while hearings proceed — a move unpacked in NOWinSA’s report on how Umalusi cancelled the 2025 matric results of 40 Pretoria pupils.
Severe Consequences Await
Minister Gwarube has been blunt: “Mercy is not on the table.” For the officials, consequences may include:
- Criminal prosecution for theft of state property, fraud and related offences
- Dismissal for gross misconduct
- Permanent blacklisting from public service
- Professional ruin, including being struck off HR bodies
- Civil liability, as the department explores recovering investigation and security costs
For the learners:
- Nullification of results in affected subjects
- Possible bans from writing the NSC for up to three examination sessions
- Criminal charges for those over 18
The severity mirrors previous high-profile cases, including when the Hawks moved in to arrest suspects in the EduMark 2024 matric results leak, underscoring that exam fraud is now treated as a serious criminal offence.
Umalusi has further warned that certificates can be cancelled even after issuance, and that failure to return a cancelled certificate may result in fines or imprisonment.
Results Still Stand — Except for the 40
Despite the breach, Umalusi has confirmed that the overall credibility of the 2025 matric results remains intact. Results will be released as scheduled, excluding the 40 implicated candidates.
Learners can check results:
- Online via the
- Official DBE portal, using their exam number.
- Through provincial portals such as Gauteng’s.
For full timelines and what to expect on release day, readers can consult NOWinSA’s guide on the confirmed 2025 matric results schedule.
Further Reading: For details on the upcoming results release and the debate around printed results, see our report: Will Newspapers Print 2025 Matric Results?
What began as a handful of “perfect” scripts has now exposed a breach at the very heart of South Africa’s examination system. And for the HR official who was meant to protect ethics, not betray them, the price of “selling out” the Class of 2025 may be measured not just in careers — but in years behind bars.
