Compliance
The Breach a Journalist Had to Report: What Gauteng's e-Panic Button Teaches Us About Section 22
On 21 September, GroundUp told the Gauteng government and the vendor behind its e-Panic Button app that the database behind the app was unsecured. According to GroundUp’s investigation, the exposed data included names, phone numbers, email addresses, vehicle registration numbers, GPS coordinates and movement histories, the contents of crime reports, and more than 5,000 report photographs. Some reports concerned domestic violence and assault. The vendor, Evolve Value Added Services, responded and fixed the reported vulnerabilities. The government’s first public response came on Tuesday 29 September, eight days after the tip-off. It said no citizens’ personal information was compromised. On 30 September the Information Regulator told the Mail & Guardian it had not received a notification from the department. By 3 October the Gauteng Legislature’s e-Government Committee was saying the app was not safe to use and asking for a report on access logs going back to the app’s 2024 launch.
Your Vendor's Breach Is Your POPIA Problem: Third-Party Risk in SA's Breach Wave
South African enterprises operate in the middle of an aggressive supply chain breach wave. Major incidents across public and private institutions—including the Companies and Intellectual Property Commission (CIPC), the Department of Justice, major credit bureaus, and national healthcare administrators—demonstrate a consistent attack strategy. Sophisticated threat actors prioritize third-party vendors, IT service providers, and cloud processors. Compromising a single service provider unlocks access to the sensitive customer databases of hundreds of corporate clients simultaneously.