The DA also questioned why the department had not informed the portfolio committee about the incident.
On Tuesday, however, the Gauteng government issued its first public response to the reports, describing the incident as an “attempted security breach”, which had been “swiftly identified and addressed”.
The department said it had established that “no citizens’ personal information was compromised as a result of the incident”.
It said the incident involved a “highly specialised organisation with advanced cybersecurity expertise and capabilities in vulnerability identification and security testing”.
MEC for e-Government, Research and Development Bonginkosi Dhlamini said the department’s technical teams had acted to address the identified vulnerabilities and strengthen the platform’s security controls. The department said it had also requested additional testing and verification.
The Information Regulator said the department’s obligations under section 22 of Popia would depend on the circumstances established around the incident.
Zondi said the section requires a responsible party to notify the regulator and affected data subjects “as soon as there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person”.
Asked whether the regulator had opened an investigation or compliance assessment into the reported breach, Zondi said it had recently conducted a Popia compliance assessment of the Gauteng e-Government department but that the outcome had not yet been finalised.
“With this development, we will look into the matter to determine if there is a need to obtain further information from the responsible party and take the necessary steps and determine the appropriate regulatory action in accordance with our mandate and the provisions of Popia,” she said.
The regulator also confirmed that it was concerned about the broader increase in security compromises in South Africa. “On this matter, we will be contacting the department,” Zondi said.
Zondi said section 22 requires affected data subjects to be notified when there were reasonable grounds to believe that their personal information had been accessed or acquired by an unauthorised person.
The Gauteng government has said that no citizens’ personal information was compromised and has urged residents to continue using the e-Panic Button. The province said the platform had 288 307 active users, had recorded 59 394 reported crimes and had an average response time of 15 minutes and 57 seconds.
The M&G asked the Gauteng department of e-Government when it first became aware of the reported exposure, whether the Information Regulator had been notified, whether affected users would be informed and whether access logs had been examined to establish whether unauthorised people had accessed the information.
The department had not responded by the time of publication.
Sheree Bega
mg.co.za
