Gauteng’s e-Panic Button app data breach has exposed the names and locations of people who made crime reports and the names of the people accused of committing crimes. Illustration: Lisa Nelson
- Gauteng’s e-Panic Button app exposed the names of people who made crime reports, the reports themselves, locations of the people making the report and people accused of committing crimes.
- The DA says it will report the e-Panic Button data breach to the Information Regulator and wants the Department of e-Government called before the legislature’s oversight committee.
- The department has told the legislature the platform contract is worth R269-million, of which R131.3-million has already been paid.
- Nearly a week after our initial report, the provincial government has said nothing about the breach and not responded to our initial query.
The Democratic Alliance says it will report the Gauteng e-Panic Button data breach to the Information Regulator. This follows our report last week that the database behind the provincial government’s emergency app was left unsecured. It exposed crime reports, including reports of domestic violence and assault, along with the names, phone numbers, locations and movement histories of the people who filed them.
In a statement, DA Gauteng spokesperson on e-Government Michael Waters said the party wants an investigation into a possible breach of the Protection of Personal Information Act, how the exposure happened, the Department of e-Government’s response, and whether it has notified the residents affected.
Waters said the department has not informed the Gauteng Legislature’s portfolio committee on e-Government about the failure.
He said this was the second breach involving sensitive information submitted to the Gauteng Provincial Government.
Waters said the party wants the department to appear before the committee, and answer how long the information was exposed, whether it was accessed by anyone unauthorised, and whether the access logs have been independently examined.
“Government systems cannot expect vulnerable residents to come forward and trust them while failing to adequately protect the sensitive information they provide,” he said.
R269-million app
When we reported on the app last week, the only contract figure we could find was on an unofficial tender listing, which put the award to systems integrator Evolve Value Added Services at R10-million.
The department has revealed that the total value of the e-Panic Button platform contract is R269-million, according to an article by MyBroadband.
Evolve was paid a total of R131.3-million over the past three financial years. The contract runs until 10 March 2027, according to the article.
(GroundUp has not confirmed the amounts.)
According to the department there have been 180,000 downloads. The department does not say how many of these are users of the app.
According to MyBroadband, uptake has slowed, with only about 15,000 new downloads between October 2025 and August 2026.
The slowdown coincided with the departure of Aura, the emergency response network that originally powered the app’s backend. In August, Aura said it had not been involved in the programme for over a year.
According to the app’s code, it is now powered by Trigger Systems.
The department has blamed competition for the low uptake, saying residents already have access to a number of private panic-button services. It is competing against apps that Aura still supports, as well as apps by other providers.
Why the government introduced yet another panic-button service instead of fixing the 10111 emergency line remains unclear.
What was in the database
We are not publishing the contents of anyone’s crime report. But it is worth showing what the system stored. We have redacted / anonymised all of the information, and we do not have any of it stored or saved anywhere.
Each crime report had the report itself, the description, the category and any photographs, together with a copy of the user’s account details and GPS coordinates. The account details included name, gender, age, phone number, email address and vehicle registration number.
Of the first 100 crime reports we examined, 11 concerned domestic violence and eight concerned assault. Fourteen related to theft and four to drug offences. Seven had images attached. There were over 5,000 crime report images exposed to the internet.
Examples of data leaked by the e-Panic Button app. We have blacked out any potential identifying information.
Still nothing to users
Almost a week after our report, neither the department nor the province has said whether it will notify the people whose information was exposed.
The Information Regulator’s guidance is that all security compromises must be reported to it, whatever the level of risk, and that the people affected must be told. Organisations are expected to establish what information was accessed, how many people were affected, and what the consequences could be.
When we reported the problems to Evolve and the Gauteng government at noon on 21 September, Evolve replied within hours, accepted our offer of assistance and subsequently set out in detail what it had fixed. The Gauteng government has still not responded. Our email was sent to Lunga Ngcongwane in the Department of e-Government and Elijah Mhlanga, spokesperson for the provincial government.
GroundUp attempted to report the incident to the Information Regulator by email. But we got an automated reply indicating that our email would not be acted upon. Instead we were directed to instead use an un-user-friendly system on the Regulator’s website to report the incident.
© 2026 GroundUp. This article is published under the GroundUp Republication Licence Version 1.0. Email [email protected] to request permission to republish.
Joel Cedras
groundup.org.za
