News24 | We found flaws in Gauteng’s panic button app. The province set the cops on us

Gauteng Department of e-Government MEC Bonginkosi Dhlamini.

Supplied/Gauteng Government

• The Gauteng Department of e-Government waited 14 days before reporting serious security flaws in its e-Panic Button app to the Information Regulator.
• The department sent SMS notifications to residents, but these did not explain what personal information had been exposed.
• A slide presented by the department to the Gauteng legislature indicated that a criminal complaint had been lodged with the police against GroundUp and/or the student who discovered the vulnerability: me.

In a presentation to the Gauteng legislature’s portfolio committees on e-Government and community safety, the Gauteng Department of e-Government said it had gone to the police to lodge a criminal complaint against GroundUp and/or the student who discovered security flaws in its e-Panic button: me.

GroundUp reported on 23 September that the database behind the province’s emergency app was left unsecured, exposing users’ names, contact details, crime reports, and location histories. Some users had reported domestic violence and assault. Uploaded images and one-time login codes were also exposed.

GroundUp informed the department and the app’s developer, Evolve Value Added Services, of the vulnerabilities at noon on 21 September.

Evolve responded promptly and fixed the issues. It also thanked GroundUp. But the department did not respond to us and issued a statement only a week later, claiming that no personal information had been compromised.

Section 22 of the Protection of Personal Information Act (POPIA) requires that when there are grounds to believe personal information has been accessed by an unauthorised person, the Information Regulator and those affected must be informed: “as soon as reasonably possible”.

READ | Gauteng govt probes allegations of data breach that may compromise sensitive information

But it seems the department only notified the Information Regulator on 5 October, hours before officials appeared before the legislature to account for the incident.

This emerged from a joint meeting of the legislature’s portfolio committees on e-Government and community safety on 5 October.

In a statement issued on Thursday, the committees expressed concern about the delay.

The DA questioned whether the department’s two-week delay complied with these obligations.

In a statement on Monday, Michael Waters, a member of the e-Government committee for the DA, demanded an explanation for the delay, as well as the release of the original security assessments and the full investigation findings.

Users received SMS messages

The department sent SMS messages to users informing them about the incident on 5 October.

The SMS said the app remained operational and urged users to be alert to suspicious communications and protect their personal information. But the message did not tell recipients what information was exposed, or for how long, or whether their own information was affected.

The SMS tells recipients that the department is investigating a cybersecurity incident affecting the e-Panic Button app.

Supplied/GroundUp

According to POPIA, affected people must be given sufficient information to protect themselves, including the possible consequences of a breach and the steps being taken to address it.

But the Gauteng department’s SMS is merely a warning and provides little information.

It said the platform had more than 280 000 registered users and about 60 000 crimes have been reported through it. But it has not provided the number of users exposed.

The committees demanded that the department provide the number of exposed users, records and images, proof of notification to the regulator, and copies of communications to residents.

Police case against us

Gauteng government spokesperson Elijah Mhlanga, who has not responded to a single GroundUp query on this matter, told The Star that a police case was being opened in connection with the incident.

Also, a slide presented to the committees by the department showed that it was trying to lodge a criminal complaint with the police. The slide stated: “SAPS case” and “Affidavit has been completed – criminal case 06/10/2026”.

Waters said the case referred to GroundUp and/or me.

We are not sure what offence is alleged or whether a case has been formally registered.

The department told the committees that the police advised that Evolve, as the database’s custodian, should open the case. Questions from GroundUp to the government and Evolve have gone unanswered.

GroundUp discovered the vulnerabilities by analysing the publicly available app and the services it connects to. No passwords needed to be guessed, or security measures bypassed. The information was accessible because the database had not been properly secured.

The department has still not established how long the information was exposed or whether anyone else accessed it.

It said the vulnerabilities GroundUp identified were fixed quickly after being reported. But there is no information about who may have accessed users’ information while it was exposed to all.

The department failed to respond to questions from GroundUp sent on Monday.

Investigation

The legislature has also called for:

• An independent investigation into the security failure alongside the investigation by Evolve, the company responsible for developing and hosting the app, whose report is expected on 20 October.
• Information on whether the department carried out proper security assessments before launching the app – the e-Panic Button is part of a contract reportedly worth R269 million, of which R131.3 million has already been paid to Evolve.
• Details of the contractual provisions on cybersecurity, data protection, incident reporting and liability.
• Details of any consequences for officials responsible for overseeing the contract.

The Portfolio Committee on Community Safety intends to engage the police about measures to protect people who report gender-based violence through the app.