"During a weekend sting operation two employees of the South African electricity public utility Eskom, together with an accomplice, were arrested for fraud involving a potential loss of billions by Eskom," spokesman Captain Paul Ramaloko said in a statement.
Alarm bells were raised when Eskom's investigation team picked up suspicious fraudulent activities within their information technology (IT) section and alerted the Hawks.
After a two month joint investigation two suspects within the IT section were identified for their suspected involvement in corrupt activities which also constituted a contravention of the Electronic Communication and Transaction Act of 2002.
"The two employees, aged 27 and 29 years, had interfered with Eskom's payroll network system which would have compromised billions of rand. They were arrested on Friday at Eskom's training facility in Midrand while on duty," said Ramaloko.
The pair then led the team to their 32-year-old suspected ringleader who was also arrested in Meredale, south of Johannesburg, after being questioned.
Ramaloko said the team searched the trio's residential properties and seized several computers, cellphones, and other devices believed to have been used in the crime.
It was the second time that the Hawks foiled a cyber heist. On November 12 they arrested a former employee of the Gautrain Management Agency for a similar crime.
The man from Pretoria was still in custody and was expected to appear in court on December 2 for a formal bail application.