Gauteng committee demands answers after e-Panic Button app data breach sparks outrage

The Gauteng Legislature’s Portfolio Committee on e‑Government and Research & Development has expressed alarm after reports revealed that the e‑Panic Button App, a tool residents rely on in moments of danger, exposed their most sensitive personal information.

University computer science students discovered the flaws while analysing the app’s code last week.

Flaw

Joel Cedras, one of the two students who exposed fraud in the South African Social Security Agency (Sassa) database in 2024, said he could easily access the personal information of Gauteng e-panic button users.

While the province’s e-government department assured users that the digital holes in its app had been patched, adding that tighter cybersecurity protocols would be implemented in the future, Committee chairperson Mbali Hlophe said the breach represents a “serious failure” of the department’s duty to safeguard the people of Gauteng and vowed to hold it accountable.

“This is not a technical glitch. It is a failure that could cost lives,” Hlophe warned.

The exposure

According to reports, a security flaw left the app’s database unsecured and accessible. The exposed records reportedly contained:

• Identities and locations of crime victims.
• Content of reports, images, contact details and vehicle registration numbers.
• In some cases, ID numbers and medical aid information.

Cedras discovered the flaw, with location data dating back to the App’s launch in 2024 – meaning residents’ data may have been vulnerable for years.

Risk to women

The committee highlighted the devastating impact on women, particularly amid a spate of murders in Ekurhuleni since July. Among the exposed records were reports of domestic violence and assault.

“For a woman who has reported an abuser, exposure can be deadly. Her name, contact details and GPS coordinates may now be in the hands of the very person she reported,” Hlophe said.

Reports also indicate that login codes were exposed, meaning anyone with a cellphone number could potentially access a victim’s account.

Government’s response

While the Department of e‑Government has claimed that no personal information was compromised, the Committee rejected this assurance and demanded evidence, including independently examined access logs.

“The department has repeatedly assured us of the app’s safety. We will now test whether those assurances were accurate,” Hlophe said.

Legal obligations under POPIA

The Committee reminded the department of its duties under the Protection of Personal Information Act (POPIA):

• Section 19 requires securing personal information.
• Section 21 requires ensuring service providers do the same.
• Section 22 requires notifying the Information Regulator and affected residents of any compromise.

Committee demands

The Committee said it will convene an urgent meeting with the department and has issued a list of demands, including:

• A complete incident timeline showing when the flaw existed, was discovered, and secured.
• Confirmation of who was informed internally and when.
• Proof of notification to the Information Regulator and affected residents.
• Measures taken to contain and fix the threat.
• Steps to protect victims of gender‑based violence whose data may have been exposed.
• Disclosure of contract clauses in the reported R269 million platform deal covering data protection, cybersecurity and POPIA compliance.
• Evidence of disciplinary action against officials and penalties against the service provider.

“A contract worth hundreds of millions cannot come with zero accountability when it fails the people it was meant to protect. We will not accept assurances without evidence,” Hlophe said.

Next steps

The Committee has given the department seven days to submit a detailed written report, including security audits and steps to prevent recurrence.

Where negligence is established, both officials and the service provider must face consequences.