A 16-year-old boy is facing renewed scrutiny after allegedly stabbing a six-year-old girl at a school on KwaZulu-Natal’s North Coast, months after being linked to an attempted bombing at a shopping centre.
The incident has raised questions about the handling of earlier warning signs and the potential risks associated with online subcultures that glorify school shootings, serial killers and extreme violence.
According to an investigation published by MyBroadband, the teenager allegedly entered The Creative Classroom in Umhlali, near Ballito, on 13 October 2026, carrying a knife and a homemade firearm.
The firearm reportedly failed to discharge. A six-year-old pupil was stabbed and required emergency medical assistance.
Rocky Schaper, a VIP protection specialist who was exercising at a nearby gym, rushed to the school after his wife alerted him to the commotion. SABC reported that he applied pressure to the injured girl’s wounds until paramedics arrived.
The child was last reported to be in a critical but stable condition in hospital.
The suspect’s identity has not been made public because of legal protections governing the identification of juvenile suspects in South Africa.
Earlier incident raised questions about the teenager’s behaviour
The school attack followed an earlier investigation into an alleged attempted bombing at Ballito Junction Regional Mall.
In March, an improvised explosive device was reportedly placed in the mall’s food court but failed to detonate. Police investigated the incident and arrested the teenager in July.
MyBroadband reported that the suspect had published a manifesto before the alleged bombing, attributing his behaviour to several personal circumstances, including alleged abuse at home and rejection by a girl.
The teenager was subsequently released from custody and placed on probation, according to the report. His case was reportedly not enrolled for formal court proceedings.
Forensic psychologist Gérard Labuschagne had previously warned against dismissing the seriousness of the alleged bombing. Speaking to the North Coast Courier in July, he expressed concern about whether the teenager’s risk had been adequately assessed and whether appropriate intervention had been considered.
The latest attack has renewed questions about how authorities respond when a young person is suspected of increasingly dangerous behaviour. The circumstances surrounding the earlier case and decisions made after the arrest would need to be examined before responsibility for any failures could be established.
Online communities and the risks of escalating behaviour
MyBroadband spoke to a former friend of the teenager, identified by the pseudonym Max, who said they had known him since 2023 and shared several online communities with him.
Max said the teenager associated himself with the True Crime Community (TCC), an online subculture in which some participants express fascination with notorious criminals and imitate the appearance or behaviour of school shooters.
The report described TCC as an online aesthetic and identity rather than a single, centrally organised group. Participants may use clothing, social media posts and provocative statements to signal their affiliation.
Max said some members appeared to be seeking attention through deliberately shocking behaviour, while others could pose a genuine risk. They also described how online bullying, social isolation and pressure from peers could contribute to increasingly extreme conduct.
The investigation linked TCC to a broader online ecosystem known as the Com, which includes decentralised networks associated in some cases with cybercrime, sextortion, physical violence and the exploitation of minors. These associations do not mean that every participant in an online subculture engages in criminal activity.
The report also referred to an unrelated case in Malmesbury in which a 16-year-old was arrested in August over alleged child sexual abuse material offences and was reportedly linked by SAPS Intelligence to the 764 network.
Max said they had raised concerns about the teenager’s behaviour with his mother as early as 2024. After the alleged mall bombing, they became more worried that his conduct could escalate into violence against others.
They also claimed to have attempted to report a separate alleged online extortion incident, but said they were told that the alleged victim needed to open the case.
MyBroadband contacted the teenager’s mother for comment. She declined to respond and requested no further contact.
The case highlights the challenges facing families, schools and law enforcement when concerning online behaviour overlaps with alleged real-world violence. Identifying credible threats, responding to reports and ensuring appropriate support for vulnerable young people remain important elements of preventing further harm.