EXCELLERATE SECURITY INTELLIGENCE REPORT

30 JUNE 2026 XENOPHOBIC / ANTI-FOREIGN NATIONAL PROTESTS SOUTH AFRICA

REPORT DATE: 11 JUNE 2026

EXECUTIVE SUMMARY

• The organisation “March and March” has set 30 June 2026 as a hard deadline for undocumented foreign nationals to leave South Africa, threatening a national shutdown if government does not comply.
• The movement has already conducted violent marches across Gauteng, KwaZulu-Natal, Eastern Cape and Western Cape since March 2026, resulting in at least 7 confirmed deaths, mass displacement of foreign nationals, and international diplomatic fallout.
• On 8 June 2026, marches occurred in Boksburg, Springs and Benoni – marchers carried golf clubs, sjamboks and wooden sticks; SAPS escorted the march.
• Gauteng SAPS is preparing large-scale deployment along the N1, N3, N4 and N12 for 30 June, but faces a leadership vacuum due to senior officer suspensions linked to the Madlanga Commission.
• The N3 corridor (Durban – Johannesburg) is the primary logistics threat. The planned action targets the N3, N1, N2 simultaneously – SA’s entire primary freight network.
• Multiple African governments (Nigeria, Ghana, Mozambique, Malawi, Zambia) have issued travel advisories or organised repatriation flights.
• NB: The situation remains extremely fluid, with the potential for rapid changes in threat levels, protest activity, and operational impacts as events unfold.

EXCELLERATE CLIENT NOTE

While national intelligence provides an overall threat picture, each property, facility, and operational environment presents unique risks, vulnerabilities, and business continuity requirements. Clients are therefore encouraged to engage with Excellerate should they require additional support, guidance, or site-specific risk assessments in preparation for the anticipated demonstrations and potential disruptions.

Excellerate will work closely with each client to assess their specific operating environment and develop tailored preparedness measures, contingency plans, security enhancements, and response strategies appropriate to their individual risk profile, ensuring the protection of people, assets, and operations.

RISK AREAS — DETAILED BREAKDOWN

HIGH RISK

Area	Province	Rationale
Ekurhuleni (Boksburg, Springs, Benoni)	Gauteng	Active marches on 8 June; industrial hub, high density of foreign-owned businesses; ATDF-ASA involvement
Johannesburg CBD, Alexandra, Hillbrow	Gauteng	Historic epicentre of xenophobic attacks (2008, 2015, 2019); dense concentration of foreign nationals and foreign-owned spaza shops
N3 Corridor (JHB–Durban highway)	Gauteng/KZN	Primary freight route; already disrupted in May (50 trucks stranded, keys stolen); SAPS fired live rounds at trucks; identified as primary shutdown target
Durban Metro / KZN Province	KwaZulu-Natal	Origin of March and March movement; HSRC data shows 60% of KZN residents want no immigrants — highest anti-immigrant sentiment of any province; worst destruction in July 2021 riots
Durban Harbour feeder routes	KwaZulu-Natal	Named target of the 30 June shutdown action

MODERATE RISK

Area	Province	Rationale
Tshwane / Pretoria	Gauteng	Major march activity in April–May; foreign-owned businesses targeted
Mossel Bay	Western Cape	55 shacks torched in May 2026; 5 Mozambican nationals killed
Port Elizabeth / Gqeberha	Eastern Cape	Nigerian nationals killed; SANDF personnel involved in beatings
N1 through Gauteng	Gauteng	SAPS-identified target route for 30 June
N4 and N12 highways	Gauteng/ Mpumalanga	SAPS-designated monitoring routes

ELEVATED RISK

Area	Province	Rationale
Cape Town / Khayelitsha	Western Cape	Named in risk geofencing; history of xenophobic violence
Aeroton / Isando (industrial areas)	Gauteng	Concentration of logistics infrastructure and foreign-owned businesses
Newcastle / Vryheid	KwaZulu-Natal	N11/R34 alternative routes — could see displaced March activity

RISKS

• Mass violence against foreign nationals on and around 30 June, particularly in Ekurhuleni, Johannesburg CBD, Alexandra, Durban and KZN townships.
• National freight network disruption (N3, N1, N2) causing supply chain collapse.
• Police unable to contain simultaneous multi-city action due to leadership gaps.
• Foreign-owned businesses looted or destroyed.
• Escalation into broader civil unrest reminiscent of July 2021 riots (R50bn+ economic damage).
• Retaliatory attacks or diplomatic incidents involving Nigeria, Mozambique, Zimbabwe.

OPPORTUNITIES

• Government’s “national action plan” on xenophobia could be fast-tracked with sufficient political will.
• Significant public condemnation of violence from civil society and opposition parties creates space for de-escalation messaging.
• Heavy SAPS pre-deployment, if effective, could deter large-scale violence.
• International pressure from AU, ACHPR and bilateral partners may force a stronger government response.

SENTIMENT ANALYSIS:  OVERALL: NEGATIVE / HIGHLY VOLATILE

Public sentiment among South African communities driving the protests is strongly anti-immigrant. Among foreign nationals, civil society, opposition parties, and the international community, sentiment is one of alarm, condemnation, and fear. Government messaging has been reactive and insufficient to reduce tension. Media coverage (Bloomberg, Al Jazeera, France 24, HRW) is uniformly alarmed.

WATCH LIST

• March and March: Monitor for specific march routes, permits filed, and any change in posture post-30 June
• ATDF-ASA (All Truck Drivers Forum): logistics disruption threat actor
• N3 Corridor: Primary flashpoint for freight disruption
• Ekurhuleni (Boksburg, Springs, Benoni): Most active march zone as of this week
• KwaZulu-Natal Province: Highest anti-immigrant sentiment; origin of the movement
• SAPS operational capacity: Watch Madlanga Commission developments affecting deployment strength
• Nigerian / Mozambican diplomatic responses: Both countries have active engagement; escalation possible
• Government immigration announcement: Ramaphosa may make a pre-30 June announcement to defuse tension; watch for timing and content

POST-30 JUNE OUTLOOK

30 June should not be regarded as not an endpoint. The grievances driving this movement – unemployment, inequality, strained services, crime – are systemic and will not be meaningfully addressed by the deadline.

If demonstrators conclude their demands have gone unmet, which is the most probable outcome, protest frequency, scale and geographic spread are expected to increase in the weeks that follow.

The political calendar reinforces this. With municipal elections on 4 November 2026, anti-immigrant rhetoric is an active electoral tool. Politicians have a direct incentive to sustain the narrative through at least Q4 2026, keeping institutional pressure to de-escalate weak.

Risk management plans should not be calibrated to a 30 June endpoint. The post-deadline period carries equal or greater risk.

EXCELLERATE RISK MANAGEMENT STRATEGY ACTIVATION

In response to the elevated risk environment surrounding the planned 30 June 2026 demonstrations, Excellerate has activated its Risk Management and Business Continuity framework to ensure the protection of people, assets, operations, and client interests.

The activation focuses on proactive risk identification, enhanced intelligence monitoring, operational preparedness, and rapid response coordination across all affected regions. Risk management best practice emphasises integrating risk assessment, decision-making, business continuity, crisis management, and security operations into a single coordinated response structure.

CURRENT STRATEGIC ACTIONS

Level 1 – Intelligence & Monitoring

• Continuous monitoring of protest activity, route planning, social media indicators, and law enforcement advisories.
• Daily risk assessments for Gauteng, KwaZulu-Natal, and other identified hotspots.
• Escalation reporting through the Excellerate Intelligence function.

Level 2 – Operational Readiness

• Review of site-specific risk registers.
• Validation of emergency response procedures.
• Verification of critical contractor and supplier continuity arrangements.
• Review of access control, guarding, and incident response capabilities at high-risk locations.

Level 3 – Business Continuity

• Identification of critical operations and essential services.
• Alternative routing for logistics and mobile response teams.
• Remote work contingencies for support functions.
• Resource allocation plans for prolonged disruption scenarios.

Level 4 – Crisis Management

• Activation of a central command-and-control structure.
• Defined escalation thresholds for incident management.
• Enhanced communication channels between clients, site management, operational leadership, and security teams.
• Real-time situational reporting during the risk period.

Level 5 – Client Protection

• Distribution of intelligence advisories and route-risk assessments.
• Site-specific threat briefings.
• Support for client decision-making regarding staffing, travel, and operational continuity.
• Rapid deployment capability for emerging incidents.

Strategic Objective

The objective of the activation is not only to respond to potential unrest, but to anticipate disruption, reduce operational exposure, protect personnel, and maintain continuity of service through a coordinated and intelligence-led approach. Effective risk management requires organisations to move from reactive crisis response to proactive resilience planning, ensuring risks are identified, assessed, treated, and continuously monitored before they materialise.

ADDENDUM:  RECENT KEY MEDIA STORIES

1. Marchers Reject Ramaphosa’s Intervention Source: Daily Maverick | Date: 8 June 2026 On 8 June, marchers in Ekurhuleni (Boksburg, Springs, Benoni) explicitly rejected President Ramaphosa’s immigration reform proposals, demanding all foreign nationals — including those with valid documentation — be removed. Why it matters: This signals the movement has escalated beyond targeting undocumented migrants; even legally present foreign nationals are now targets.

• SAPS Preparing Large-Scale Deployment for 30 June Source: EWN | Date: 10 June 2026 Gauteng SAPS has activated contingency plans covering the N1, N3, N4 and N12 with high-visibility policing, roadblocks and checkpoints. Why it matters: Police response is being taken seriously, but capacity is degraded by the Madlanga Commission suspensions.

• Mozambique Confirms 5 Citizens Killed Source: Al Jazeera | Date: 2 June 2026 Mozambique confirmed 5 nationals killed in xenophobic attacks, with 7 total deaths reported. Why it matters: The violence has already crossed a threshold that is triggering formal diplomatic responses and repatriation operations.

• N3 Shutdown Preview — 50 Trucks Stranded Source: DigitFMS | Date: June 2026 A recent truck driver shutdown previewed 30 June tactics: N3 blocked, truck keys stolen, 50 vehicles stranded. SAPS fired live rounds at trucks. Why it matters: The 30 June action is likely to be significantly more organised and larger in scale.

• Human Rights Watch — New Waves of Xenophobic Attacks Source: HRW | Date: 20 May 2026 HRW documented violent attacks across Johannesburg, Pretoria and Durban with insufficient police response; vigilantes preventing migrants from accessing healthcare and schools. Why it matters: Institutional failure to protect foreign nationals pre-30 June increases the risk of unchecked mob violence on the day.

• Foreign Nationals Fear Growing Deadline Pressure Source: EWN | Date: 26 May 2026 Foreign nationals — including documented migrants — living in fear, many choosing to stay indoors, close businesses, or flee. Why it matters: Displacement and economic disruption are already occurring before the deadline arrives.