GroundUp revealed that an unsecured database behind Gauteng’s e-Panic Button app exposed sensitive user data, including names, contact details, crime reports, images, one-time login codes, and location histories. The vulnerability was first reported to the Gauteng Department of e-Government on 21 September 2026 and publicly disclosed by GroundUp two days later.
Despite the severity, the Gauteng department waited almost two weeks before notifying the Information Regulator. Official documents indicate that notification to the Regulator only occurred on 5 October 2026, well after the initial discovery of the flaw.
The Gauteng Department of e-Government stated that the vulnerability was “swiftly identified and addressed,” and insisted no personal information had been compromised. However, the Information Regulator initially confirmed it had not received any notification from the department and announced it would engage Gauteng regarding the breach.
In response to the revelations and delayed reporting, the Gauteng Provincial Legislature’s portfolio committees expressed deep concern. They demanded accountability and sought full details on the security assessment, contractual safeguards, and how the incident was managed. The committees described the exposure of users’ identities and locations as alarming for an app designed to enhance public safety.
Timeline highlights show GroundUp alerted the department and developer at noon on 21 September, published their findings on 23 September, and the government claimed to have fixed the issue by 29 September. The Information Regulator’s involvement became public on 30 September, with official notification following on 5 October. By 8 October, the legislature publicly called for accountability. GroundUp’s follow-up report on 13 October noted ongoing concerns over the two-week delay in reporting and mentioned that a criminal complaint was under consideration.
The exact number of affected users and whether data was accessed by unauthorised parties remain unconfirmed. Claims of exposure of ID numbers, driver’s licence details, medical aid information, or vehicle registrations have not been independently verified across multiple sources.
This incident highlights the risks associated with government-run digital public safety tools holding sensitive personal data. Delayed disclosure and unclear communication have raised public trust concerns, underscoring the need for stronger transparency and cybersecurity practices across provincial e-governance systems.
For communities in the Cape Flats and beyond, the case serves as a reminder that secure handling of personal information is critical for digital crime-reporting platforms to be effective and trustworthy.
Cape Flats News will continue monitoring the response from Gauteng authorities and the Information Regulator, as well as any developments regarding investigations or legislative action.