12/10/2026
Two weeks to report a panic-button breach. Then they let the company investigate itself.
The Gauteng Department of e-Government was alerted to the e-Panic data breach on 21 September 2026. It waited two weeks to tell the Information Regulator. The breach allegedly exposed sensitive personal information of hundreds of thousands of residents. The app has more than 280 000 registered users and about 60 000 alerts.
In a joint Portfolio Committee meeting, it emerged that Evolve, the company that developed and hosts the app, was allowed to appoint its own investigator. The preliminary report is only expected on 20 October. The department cannot tell residents their information is safe while admitting it has not established the extent of the exposure, or when the vulnerability first arose.
Section 22 of POPIA requires notification as soon as reasonably possible. Michael Waters MPL will ask MEC Bonginkosi Dhlamini why the delay, whether due diligence and independent pe*******on tests were done, who authorised deployment, and what assurances were given. Instead of fixing issues flagged in GroundUp, SAPS advised Evolve to open a criminal case against the person who exposed the vulnerability.
The committees have demanded an investigation independent of Evolve’s. An emergency app should not put your identity and location at risk.
Panyaza Lesufi SABC News eNCAnews
Read more: https://dagauteng.org.za/2026/10/da-exposes-lesufi-governments-two-week-delay-in-reporting-e-panic-data-breach-to-information-regulator
