Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
Breach occurred 2016-09-07Verifiedeservices.durban.gov.za
What happened
In September 2016, the new eThekwini eServices website in South Africa was launched with a number of security holes that lead to the leak of over 98k residents' personal information and utility bills across 82k unique email addresses. Emails were sent prior to launch containing passwords in plain text and the site allowed anyone to download utility bills without sufficient authentication. Various methods of customer data enumeration was possible and phishing attacks began appearing the day after launch.
Data exposed
Frequently asked questions
The eThekwini Municipality data breach occurred on September 7, 2016. It was added to Have I Been Pwned's breach catalog on September 15, 2016.
81,830 accounts were affected by the eThekwini Municipality data breach, according to Have I Been Pwned's records.
The eThekwini Municipality breach exposed the following data types: Dates of birth, Deceased date, Email addresses, Genders, Government issued IDs, Names, Passport numbers, Passwords, Phone numbers, Physical addresses, Utility bills.
Yes. Have I Been Pwned has verified the eThekwini Municipality breach, meaning there's confirmed evidence the exposed data is genuine and tied to real accounts.
Use KazaSec's free Email Breach Checker (/tools/breach-check) to check whether a specific email address has surfaced in the eThekwini Municipality breach, or any other known breach — the tool never stores what you search.
Our free Email Breach Checker tells you whether a specific email address has surfaced in this breach — or any other known breach — without ever storing what you search.
Check your email →Talk to us about this
We help organizations find and fix the gaps that lead to a breach, before they do.