eThekwini municipality website leaks user data - expert

Johannesburg - KwaZulu-Natal's eThekwini municipality e-services website is hackable with residents’ personal information such as ID numbers and other data being exposed with just the change of a web address, according to an expert.

READ: eThekwini shuts down e-services after user data leak

Local software developer, Taylor Gibb, has said that by simply changing a part of the web URL on the eThekwini website, full details on users can be seen. Gibb outlines this in a blog post that he wrote and posted on Thursday.

Gibb told Fin24 that it was a trivial task for someone who knew "a thing or two about computers".

“The first problem I noticed is that they emailed all users their usernames and passwords, which meant they are storing our data in plain text,” Gibb from Durban said. 

“This prompted me to investigate further. What I found was shocking. By changing a single portion of the URL, you are able to see full details for any other registered user on the system. You can see their email, ID number, deceased status, gender, account number and cellphone number,” he added.

“The government has an obligation to protect our data, and I have an obligation to alert you that your data is not safe,” he said.

“In a matter of minutes, someone could have all their information at their fingertips. The code to dump their entire database, which contains everyone’s personal information would be less than 10 lines of code,” Gibb added.

Fin24 approached eThekwini officials for comment but the municipality did not immediately respond.

Instead, the municipality told Gibb on Twitter: "We are looking into this. Sorry about that."

Are you an eThekwini resident and what are your views on this? Tell us by clicking here.

The municipality just after 13:40 on Thursday then said on Twitter that it was moving to take the website offline to beef up its security.

@KyleVenktess on Twitter.

We live in a world where facts and fiction get blurred
In times of uncertainty you need journalism you can trust. For 14 free days, you can have access to a world of in-depth analyses, investigative journalism, top opinions and a range of features. Journalism strengthens democracy. Invest in the future today. Thereafter you will be billed R75 per month. You can cancel anytime and if you cancel within 14 days you won't be billed. 
Subscribe to News24
Rand - Dollar
Rand - Pound
Rand - Euro
Rand - Aus dollar
Rand - Yen
Brent Crude
Top 40
All Share
Resource 10
Industrial 25
Financial 15
All JSE data delayed by at least 15 minutes Iress logo
Company Snapshot
Government tenders

Find public sector tender opportunities in South Africa here.

Government tenders
This portal provides access to information on all tenders made by all public sector organisations in all spheres of government.
Browse tenders