Gauteng e-Panic Button: POPIA Breach Reporting Delayed 2 Weeks

• The Gauteng Department of e-Government delayed reporting a data breach in its e-Panic button app to the Information Regulator for two weeks.
• Sensitive user data, including names, contact details, crime reports, and location histories, was exposed due to an unsecured database.
• The department attempted to file a criminal complaint against GroundUp and the student who discovered the security flaws.
• User notifications sent via SMS were deemed inadequate under POPIA, failing to provide sufficient details about the breach or its impact.
• Legislative committees have demanded full disclosure from the department regarding the number of affected users and compliance with notification requirements.

Under Section 22 of the Protection of Personal Information Act (POPIA), organizations are mandated to inform both the Information Regulator and affected individuals "as soon as reasonably possible" when there are grounds to believe that personal information has been accessed by an unauthorized party.

The Gauteng Department of e-Government (GDeG) faced scrutiny for a significant delay in reporting security vulnerabilities within its e-Panic button application to the Information Regulator. This delay extended for two weeks following the initial discovery and notification of the flaws. The department also made an attempt to initiate a criminal complaint against GroundUp and the student who identified these security weaknesses, as revealed in a presentation to the Gauteng legislature's Portfolio Committees on e-Government and Community Safety.

GroundUp initially reported on September 23 that the database supporting the province's emergency application was left unsecured. This exposure compromised sensitive user data, including names, contact details, records of reported crimes, and location histories. Furthermore, uploaded images and one-time login codes were also accessible, with some users having reported incidents of domestic violence and assault through the system. GroundUp promptly informed both the GDeG and the app's developer, Evolve Value Added Services, of the vulnerabilities at noon on September 21. While Evolve swiftly addressed and rectified the issues, expressing gratitude to GroundUp, the GDeG remained unresponsive to GroundUp's inquiries and subsequently issued a statement a week later, controversially asserting that no personal information had been compromised.

Under Section 22 of the Protection of Personal Information Act (POPIA), organizations are mandated to inform both the Information Regulator and affected individuals "as soon as reasonably possible" when there are grounds to believe that personal information has been accessed by an unauthorized party. Despite this clear legal requirement, the Gauteng Department of e-Government only formally notified the Information Regulator on October 5. This notification occurred mere hours before GDeG officials were scheduled to appear before the legislature to account for the incident, a fact that emerged during a joint meeting of the Portfolio Committees on e-Government and Community Safety on the same day. The committees subsequently voiced their concerns regarding this two-week delay.

Further compounding the compliance issues, the Democratic Alliance (DA) publicly questioned whether the department's actions fulfilled its obligations under POPIA. Michael Waters of the DA demanded a comprehensive explanation for the delay, alongside the release of original security assessments and the full findings of any investigation. On October 5, the GDeG dispatched SMS messages to users, informing them of the incident. However, these messages were criticized for their lack of detail, merely stating that the app remained operational and advising users to be vigilant against suspicious communications. Crucially, the SMS did not specify what information had been exposed, the duration of the exposure, or whether an individual recipient's data was affected. POPIA stipulates that affected individuals must receive sufficient information to protect themselves, including potential consequences of a breach and the steps being taken to mitigate them, a standard the GDeG's message failed to meet.

The e-Panic button platform boasts over 280,000 registered users and has facilitated approximately 60,000 crime reports. Despite these figures, the Gauteng Department of e-Government has not disclosed the number of users whose data was exposed. In response to the department's handling of the breach, the legislative committees have formally demanded that the GDeG provide the exact number of exposed users, records, and images.

The attempt to lodge a criminal complaint against those who uncovered the security flaws adds another layer of controversy. Gauteng government spokesperson Elijah Mhlanga confirmed to The Star that a police case was being opened in connection with the incident, though he has not responded to GroundUp's inquiries. A slide presented by the department to the committees explicitly indicated an effort to file a criminal complaint, noting "SAPS case" and "Affidavit has been completed - criminal case 06/10/2026." Michael Waters of the DA confirmed that this case targeted GroundUp and/or the student who identified the vulnerabilities. The specific offense alleged remains unclear, and it is unknown whether a formal case has been registered. The department informed the committees that police advised Evolve, as the custodians of the database, to be the party to open the case. GroundUp's attempts to obtain further information from both the government and Evolve have, to date, gone unanswered.

Compliance officers and legal counsel should note the Gauteng Department's apparent non-compliance with POPIA Section 22 regarding timely and adequate data breach notification, which could set a precedent for enforcement actions. Furthermore, the attempt to lodge a criminal complaint against those who exposed the vulnerability highlights the legal risks of retaliating against security researchers rather than addressing the underlying issues.

Source: Original reporting via GroundUp