Government department waited two weeks to report data breach exposing 280,000 South Africans

The Gauteng Department of e-Government took two weeks to report a data breach affecting its e-Panic Button to the Information Regulator (IR).

The Gauteng government was first alerted to the breach on 21 September by cybersecurity researcher and GroundUp journalist Joel Cedras.

The breach allegedly exposed the sensitive information of hundreds of thousands of South Africans, with the Department confirming that the app had 280,000 registered users.

Section 22 of the Protection of Personal Information Act (POPIA) requires notifying the IR as soon as reasonably possible of suspected unauthorised access to personal information.

By 30 September 2026, the IR had informed the Mail & Guardian that it had still not received a Section 22 security compromise notification from the Department regarding the breach.

As a result, the IR said it would engage with the Gauteng Department of e-Government to establish the details of the breach and urge the Department to adhere to POPIA regulations.

The Department also allowed the company responsible for developing and hosting the e-Panic Button app, Evolve, to appoint its own investigator into the security breach.

This emerged at a joint meeting of the Portfolio Committee on e-Government and Community Safety, with Member of the Gauteng Provincial Legislature Michael Waters describing this as concerning.

“Allowing the company to choose the person investigating those measures raises significant concerns about the credibility and independence of the process,” Waters said.

“The department cannot tell residents that their information is safe while simultaneously admitting to the Legislature that it has not established the extent of the exposure.”

The preliminary investigation report is due on 20 October 2026, nearly a month after the breach was first reported to the Department.

The South African Police Service (SAPS) reportedly advised Evolve to also open a criminal case against Cedras, alleging that his exposure of the breach was an attempted hacking job.

Meanwhile, the Department admitted that the investigation had yet to establish when the vulnerability first arose or how many residents had been affected.

Waters tabled questions to the MEC for e-Government, Bonginkosi Dhlamini, about why it took the Department two weeks to notify the IR and whether this delay complied with its legal obligations.

He also asked whether the Department had done due diligence before implementing the system, whether independent penetration tests were conducted, and who authorised its deployment.

“Residents who use an emergency application to seek protection from criminals should never have to fear that the system intended to protect them could expose their identities, locations, and personal circumstances,” Waters said.

“The Gauteng Provincial Government owes those residents answers, not premature assurances and an investigation whose independence remains in question.”