Criminal probe looms as 40 pupils’ results withheld in NSC exam paper leak scandal

The results of 40 matric pupils in Tshwane will be temporarily withheld pending the outcome of a further independent investigation relating to leaked question papers, which could include criminal prosecution. 

This was confirmed during a briefing by the Department of Basic Education, in which Minister Siviwe Gwarube presented the interim findings and recommendations of the National Investigation Task Team (NITT) on the 2025 NSC examination breach.

According to evidence gathered during the independent investigation, it was confirmed that an Education Department official – whose child was an NSC 2025 candidate – was located in the human resources department and a possible second suspected official remains subject to corroboration through the ongoing forensic and investigative work.

The son of the human resources employee is alleged to have been involved in this breach, and he subsequently formed part of the distribution chain.

The NITT reported that the breach was contained to 40 candidates in the Tshwane area, across eight schools, and therefore localised. The department confirmed that, in line with protocols, implicated pupils may have their results nullified if they are found guilty through independent investigations of each pupil.

According to leaked paper marking guidelines, the guilty pupils will not be able to rewrite the exams for three exam sessions, confirmed Gwarube.

Additionally, evidence gathered by the NITT indicated that the distribution was done via USB transfers, printed hard copies, WhatsApp, screenshots, and messaging.

The NITT reported that evidence currently confirms seven leaked question papers, limited to the following subjects and papers: English Home Language: Paper 1, Paper 2 and Paper 3; Mathematics: Paper 1 and Paper 2; and Physical Sciences: Paper 1 and Paper 2.

Gwarube said: “However, the NITT emphasised that confirming the exact extraction pathway remains part of the continuing forensic work. At the time of reporting, the forensic investigation had not yet yielded definitive evidence pinpointing the specific machine and time of extraction from the secure DBE server, and the forensic scope has been expanded, with investigations with law enforcement continuing.”

A criminal probe is under way after the matter was reported to the SAPS, Gwarube confirmed. 

“A forensic service provider was appointed to investigate electronic devices and relevant evidence that may have facilitated the breach, and the forensic scope has been expanded in order to establish the extraction source/timeline and corroborate involvement of any additional suspects, as applicable,” said Gwarube.

According to NITT Chairperson, Professor Chika Sehoole, ChatGPT was one of the portals used to reformulate answers. 

“Based on leaked marking guidelines, Meta AI and ChatGPT were also used by some candidates to structure and reformulate answers. Individual papers with marking guidelines were sold as well as individual pages depending on affordability of items or finances of candidates,” said Professor Sehoole.

Professor Sehoole conducted the mandate of the NITT with Brian Schreuder, who was the superintendent general of Education, as deputy chair.

Gwarube said: “On the evidence available to date, the NITT reported that the breach originated within the DBE’s secure national examinations environment – that is, within the secure environment where NSC question papers are set, processed, and managed.

“The NITT further indicated that, on the evidence available to date, a DBE official whose child was an NSC 2025 candidate is alleged to have been involved in this breach, with the learner subsequently forming part of the distribution chain. The NITT also noted that a possible second suspected official remains subject to corroboration through the ongoing forensic and investigative work.”

Gwarube added that earlier in the day, Umalusi approved the 2025 National Senior Certificate (NSC) results and confirmed the credibility and integrity of the 2025 NSC examinations, and, as part of this process, engaged with the interim findings and recommendations placed before it.

Gwarube said on Umalusi’s approval, it is a clear assurance to every candidate and every parent: the 2025 NSC remains credible.

“Where wrongdoing is proven, it will be addressed firmly – but we will not allow a small number of offenders to taint the achievements of the overwhelming majority,” said Gwarube.

The DBE said it is implementing measures aligned with the NITT’s recommendations to:

• Strengthen end-to-end security across the examinations value chain, including tighter controls for handling, processing, storing, and managing examination papers within secure environments;
• Maintain and enhance high-risk centre monitoring, informed by evidence and risk profiling;
• Strengthen and standardise candidate screening and processing prior to entry to examination rooms across centres;
• Investigate and act on invigilation complacency/laxity, and strengthen invigilation oversight – recognising practical risks in certain venues that constrain invigilator movement; and
• Update controls to keep pace with evolving technology risks (including wearables and AI-enabled tactics) and strengthen prevention and detection accordingly.

“In addition, the DBE is undertaking measures to strengthen its information security capacity and controls in the examination’s environment (including, among others, strengthening access control, secure file transfer mechanisms, encryption, and removable media controls),” said Gwarube. 

chevon.booysen@inl.co.za