Investigators are probing how XET Solutions, the company that bankrolled former Ekurhuleni city manager Imogen Mashazi’s R3.35m private-jet junket to London, managed to extract R483m from the metro through alleged fraud, ghost employees and wildly inflated billing.
The Sunday Times has obtained a treasure trove of financial records — including payment statistics reports and invoice registers — laying bare the IT service provider’s staggering bonanza. The records have been corroborated by senior executives in the municipality.
Among the startling revelations are that:
- One R4m payment to XET was processed and released to the company while Mashazi was en route to London on the jet;
- XET is at the heart of an IT rates billing scam in the 2023/24 financial year that cost the municipality R2bn;
- Of the R483m paid to XET, about R18m cannot be linked to any processed invoices, raising questions about whether the full amount is supported by legitimate documentation; and
- On June 30 2022 — the last day of the financial year — Ekurhuleni rushed to settle seven XET invoices worth R48m, five of which were submitted only on that day. The largest invoice was for R23m, while two others were for more than R7.5m each.
Two senior Ekurhuleni executives, speaking on condition of anonymity, told the Sunday Times that officials in the municipality were probing allegations that XET systematically inflated invoices and brazenly billed for “ghost” employees who never took part in the projects the company claims they worked on.
XET … does not deserve half the amount they billed. Their billing schedules even include the children, who don’t work for the municipality, of senior officials employed by the metro
— anonymous senior executive
One of the executives said: “I’ve never seen such looting in my life. XET … does not deserve half the amount they billed. Their billing schedules even include the children, who don’t work for the municipality, of senior officials employed by the metro. All will be revealed in due course.”
The company’s R483m jackpot flows from a cluster of lucrative contracts it scored from the metro over the last few years.
Last week, the Sunday Times revealed that since 2019 Ekurhuleni has handed the company a steady stream of at least five contracts.
We also exposed XET as the entity that paid for the private jet that ferried Mashazi; her husband, Raymond Mashazi; pharmacist-turned-businesswoman Dineo Seletswane; and a fourth, unnamed companion to London for a lavish three-day shopping spree in July 2022.
Though XET ultimately bankrolled the Dassault Falcon 900EX flight, it was politically connected businessman Zesimdumise “Ze” Nxumalo who handled the payments to Onyx Aviation, effectively fronting the charter arrangement.
The Sunday Times report revealed that on July 19 2022, XET deposited R5.7m into ZIG Revenue Management’s account, using the reference “XET SOLUTIONS”. Nxumalo, through ZIG Revenue Management, a company he owns and directs, transferred R3.35m to Onyx in three transactions between July 23 and August 1 2022.
Nxumalo told the Sunday Times he chartered the jet on behalf of Ntokozo Xaba, the businessman believed to be the founder and chair of XET. He said he was surprised later on to learn that Mashazi, and not Xaba, had travelled on the flight to London.
At the time of the trip, Mashazi was Ekurhuleni’s city manager, while XET was actively benefiting from lucrative contracts with the metro. Despite the glaring conflict, Mashazi has failed to answer whether she disclosed the luxury junket to the Ekurhuleni council.
The financial data obtained by the Sunday Times shows that on July 28 2022 — the day Mashazi and her crew departed for London — XET submitted two invoices worth just more than R2m each. Officials paid them both the following day. The rapid turnaround is unusual, as government departments settle invoices only on monthly cycles.
Beyond allegedly financing Mashazi’s London junket, XET also stands accused of being at the centre of a billing saga that saw Ekurhuleni lose revenue estimated at more than R2bn in the 2023/24 financial year.
According to memoranda and correspondence in the Sunday Times’s possession between senior Ekurhuleni executives, towards the middle of 2023 the metro’s energy department was in the process of appointing a service provider to manage the council’s electricity automated meter reading (AMR) infrastructure, meter data management and billing services contract.
However, Moloko Monyepao — the city’s chief information officer (CIO), who is currently on suspension — ordered that the procurement process be stopped. He insisted that his department be the one managing the three-year AMR infrastructure, meter data management and billing services contract starting on July 1 2023.
On May 2 2023, the council’s energy chief, Tshilidzi Thenga, wrote to Monyepao raising misgivings about the transfer of the contract to the information and communications technology (ICT) department. He argued that, should anything go wrong, the city would not be able to collect significant revenue from large power users (LPUs), which account for R22bn of the metro’s energy revenue.
To mitigate risks, Thenga proposed that “the department of energy should continue with the SCM [supply chain management] process to appoint a service provider on a month-to-month basis for a period not exceeding one year until a smooth transition process is completed, whichever comes first, or the current contract be extended on a month-to-month basis for a period not exceeding six months, until a smooth transition process is completed, whichever comes first”.
In the wake of the hacking scandal, Ekurhuleni swiftly suspended Monyepao and hauled him before a disciplinary hearing, which is now under way
On May 8 2023, Monyepao, whom Mashazi had promoted to CIO in late April 2022, wrote back to Thenga, insisting that the contract be handed over to him.
“The ICT department comments are as follows: that the ICT department [should take] over the entire contract for the remote metering service provider (RMSP), material management and stores,” he wrote. “There will be no need to extend the current contract, and the energy department does not have to continue with the SCM process to appoint a service provider for the above services.”
Thenga lost the fight, which paved the way for XET’s appointment. The company, which was already on the metro’s professional services panel (skilled IT experts who help organisations design, implement, manage and optimise technology systems) was appointed on a three-year contract to provide enterprise resource planning (ERP). ERP is an integrated IT system companies use to run and manage their core business operations. Ekurhuleni’s IT infrastructure, including its ERP, is hosted on a platform called Solar, developed by the Business Connexion Group, a subsidiary of the JSE-listed telecoms giant Telkom.
Following XET’s ERP appointment, the company was tasked with setting up IT infrastructure capable of remote meter reading, meter data management and billing services for about 13,000 LPUs — but it struggled, and its implementation of the system was chaotic.
A senior Ekurhuleni executive who spoke to the Sunday Times anonymously said XET’s implementation of the system was so disorganised that in the first three months of the 2023/24 financial year — July to September 2023 — not a single LPU meter was read. The mess is also captured in a letter Tshilidzi wrote to Ekurhuleni’s mayoral committee in February last year.
“The remote metering service provider contract was discontinued from July 1 2023. This resulted in all large power users being billed on interims/estimates for the period July-September 2023, causing underbilling of the LPUs. The ICT department indicated that it [would] take over all the functions performed by the RMSP, and none materialised except the ARM. The field activities were not provided by the ICT department.”
While XET was scrambling, struggling to grasp even the basics of remote meter reading, its IT billing systems were hacked. The attackers — working in collusion with municipality insiders — deliberately manipulated electricity billing data, slashing what businesses and residents owed to a fraction of the true amounts. In some cases, they went even further, wiping out debts for rates and taxes altogether to fraudulently secure rates-clearance certificates to fast-track the sale of properties.
When officials discovered the R2bn black hole, they appointed OMA Chartered Accountants to conduct an investigation. OMA’s investigators found that a cybercrime syndicate had completely taken over the metro’s IT billing infrastructure. They found surveillance and malicious spyware embedded on critical servers and workstations responsible for authentication and access control.
The keylogging software silently captured keystrokes on hacked computers, copying usernames, passwords and other important credentials, thereby blowing wide open the municipality’s IT infrastructure to criminals.
In the wake of the hacking scandal, Ekurhuleni swiftly suspended Monyepao and hauled him before a disciplinary hearing, which is now under way.
Neither Monyepao nor Xaba responded to the Sunday Times’s questions. Ekurhuleni also did not respond to questions sent to it on Friday.
Would you like to comment on this article?
Sign up (it's quick and free) or sign in now.
Please read our Comment Policy before commenting.