By The Gauteng Provincial Government is facing mounting political pressure following revelations that a critical security vulnerability in the official e-Panic Button App left sensitive personal data of vulnerable residents exposed.
The flaw, reportedly dating back to the application’s launch in 2024, has triggered swift demands for accountability from both the provincial legislature and opposition parties.
A Haven for Help Compromised
The e-Panic Button App is promoted as a crucial lifeline for residents facing immediate danger, allowing them to report crimes and call for assistance. However, an investigation revealed an unsecured database linked to the application, exposing highly sensitive details.
Among the compromised data are the names, identities, GPS locations, location histories, and photographs of individuals reporting crimes, alongside one-time PINs (OTPs) used to log into the system.
Most alarmingly, the breach included the contents of crime reports, encompassing sensitive cases of domestic violence and assault, alongside driver’s license details and medical aid information. The vulnerability reportedly required no sophisticated hacking skills to exploit, meaning a tech-savvy user could access the records.
The flaw was uncovered by Joel Cendras, a Stellenbosch University student, rather than being detected internally by the Department of e-Government.
Legislative Scrutiny and Demands for Answers
The Gauteng Provincial Legislature’s (GPL) Portfolio Committee on e-Government and Research & Development has expressed deep alarm over the breach, criticizing the Department of e-Government for failing its fundamental duty to protect residents.
Chaired by Honourable Mbali Hlophe, the committee highlighted that the department has repeatedly appeared before them to give glowing assurances regarding the app’s safety.
In response to the crisis, the committee has issued strict demands to the executive department, requiring:
- Detailed explanations of the containment and mitigation measures implemented since the flaw came to light.
- Immediate confirmation on whether the exposed data was accessed or misused by unauthorized parties.
- Notification protocols executed for affected residents and the Information Regulator.
- An exhaustive written report outlining timelines, independent security audits, and risk controls to prevent future occurrences.
The committee has made it clear that it will not accept unverified assurances and intends to exercise its full constitutional mandate to ensure public safety and privacy are restored.
DA Steps in to Trigger POPIA Investigations
Political opposition has moved quickly to escalate the matter. Michael Waters MPL, the Democratic Alliance (DA) Gauteng Spokesperson for e-Government, announced that the party will formally report the data breach to the Information Regulator of South Africa.
The DA is calling for a thorough investigation into potential violations of the Protection of Personal Information Act (POPIA).
The DA emphasized that this marks the second major data breach involving sensitive information submitted to the Gauteng Provincial Government. Pointing to the province’s ongoing crisis with gender-based violence and femicide—underscored by the recent tragic deaths of women in Ekurhuleni—the party warned that compromised digital safety creates a “double crisis” for victims who are encouraged by the state to speak out.
Furthermore, the opposition has questioned the department’s fiscal priorities, asking whether limited public funds should continue supporting troubled tech initiatives like the e-Panic button instead of overhauling core cybersecurity infrastructure.
The party asserts that compromised data security not only endangers citizens but also threatens public confidence necessary to stimulate the digital economy and job creation in the province.
As pressure mounts, the Department of e-Government faces intense scrutiny to account for how a vulnerability of this magnitude went undetected for years, while residents await answers on whether their most private moments of crisis have been compromised.
