[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f3bjrdfcsqt008":3},{"success":4,"breach":5},true,{"_id":6,"name":7,"title":8,"slug":9,"domain":10,"breachDate":11,"addedDate":12,"modifiedDate":13,"contentUpdatedAt":14,"source":15,"sourceUrl":16,"sourceUrls":17,"pwnCount":18,"affectedCount":18,"affectedCountStatus":19,"affectedCountLowerBound":20,"affectedCountUnit":21,"hasEnglishDescription":4,"severity":22,"dataClasses":23,"description":35,"seoTitle":16,"seoTitleEn":36,"seoDescription":16,"seoDescriptionEn":37,"logoUrl":38,"isVerified":4,"isSensitive":4,"isSpamList":39,"isMalware":39,"company":40},"68e3266eda11adda488251b5","e-thekwini-municipality","eThekwini Municipality Data Breach","ethekwini-municipality","eservices.durban.gov.za","2016-09-07T00:00:00.000Z","2016-09-15T00:01:47.000Z","2026-07-02T12:26:55.059Z","2026-07-18T23:50:19.041Z","Third party breach","",[],81830,"known",null,"unknown","Medium",[24,25,26,27,28,29,30,31,32,33,34],"Dates of birth","Deceased date","Email addresses","Genders","Government issued IDs","Names","Passport numbers","Passwords","Phone numbers","Physical addresses","Utility bills","\u003Cp>eThekwini Municipality is the municipality serving the Durban area in South Africa. With the launch of the new eServices site in September 2016, personal information and billing records of more than 98,000 residents were exposed due to security vulnerabilities; more than 82,000 unique email addresses were recorded.\u003C\u002Fp>\u003Cp>This record carries high sensitivity due to the context of public service and municipal billing. Findings such as sending passwords in plain text, the ability to download invoices with insufficient verification, and personal data being accessible through numbering have been reported. Therefore, not only account security but also identity and invoice fraud should be considered.\u003C\u002Fp>\u003Ch2>Leaked Data Types and Risks\u003C\u002Fh2>\u003Cp>Data classes tracked in the eThekwini Municipality record should be treated as birth dates, death date information, email addresses, gender information, official identification numbers, name-surname information, passport numbers, password data, phone numbers, physical addresses, and billing records. Birth dates are persistent personal data that can be used in identity verification questions, age-based targeting, and profile enrichment. Death date information provides a sensitive context that can be misused in family and inheritance-related fraud messages. Email addresses can be used for targeted phishing, password reset scenarios, and account matching across different services. Gender information can provide additional personalization context in profile extraction and targeted messages.Official identification numbers are high-risk areas for identity verification, fraudulent applications, and official transaction-themed fraud. Name-surname information makes fake support, fake delivery, fake invoice, and customer service messages more convincing. Passport numbers are sensitive data that can be used in travel, visa, identity verification, and official transaction-themed fraud. Password data directly increases the risk of account takeover, especially if the same password is reused on other services. Phone numbers allow personalized fraud scenarios to be established via SMS, calls, and messaging applications. Physical addresses can be used in social engineering messages related to delivery, billing, subscriptions, and local services.Since invoice records are associated with address, service account, and household information, they can be misused in identity verification and fraudulent payment requests.\u003C\u002Fp>\u003Cp>When fields such as official ID, passport, invoice, address, phone number, and date of birth are found together, identity verification processes can be misused. Utility bill data reinforces fake payments, municipal debts, or account update messages in the context of address proof and service accounts.\u003C\u002Fp>\u003Ch2>Verified Scope and Boundaries\u003C\u002Fh2>\u003Cp>This record is related to the domain eservices.durban.gov.za and the September 2016 eServices incident. The scope includes date of birth, date of death, email, gender, official ID, full name, passport, password, phone, physical address, and billing records. Other municipal systems or all public records should not be generalized within this scope.\u003C\u002Fp>\u003Cp>Areas not present in this record should not be described as if they have leaked. Full payment cards, official identification, private messages, health data, bank information, device content, or data belonging to other platforms should only be included in the risk assessment if they are explicitly present in the record. The text is based on verifiable data classes and the known boundaries of the incident.\u003C\u002Fp>\u003Ch2>User Groups at Risk\u003C\u002Fh2>\u003Cp>Residents using eThekwini eServices, individuals who track their bill or municipal account via email, users with official ID or passport information in the system, and individuals using a municipal bill as proof of address are at high risk.\u003C\u002Fp>\u003Cp>Users who use the same email address on different services, reuse their old passwords, keep their nicknames the same across many communities, or do not separate their work and personal accounts are at higher risk. The risk in profile and data broker records arises from the combination of very different domains from a single account, creating detailed context about the person.\u003C\u002Fp>\u003Ch2>Urgent Measures to Be Taken\u003C\u002Fh2>\u003Cp>Users should renew their old eServices password and any other accounts that use the same password. Messages containing municipal bills, debts, address verification, or payment links should only be confirmed through official channels; identity or passport information should not be shared.\u003C\u002Fp>\u003Cp>Users in the positive match area should renew their passwords on accounts where they use the same or similar passwords, enable two-factor authentication where possible, and check their recent sessions. Records that do not contain passwords but include contact, billing, address, or profile data should be monitored for unexpected calls, offers, support, billing, and verification messages.\u003C\u002Fp>\u003Ch2>Long-Term Security Strategies\u003C\u002Fh2>\u003Cp>In the long term, the habit of using a password manager, unique passwords, two-factor authentication, and removing unnecessary personal information from accounts reduces risk. Reusing the same email address across different platforms makes it easier to combine data from different breaches; using a separate email or alias for critical accounts can be considered.\u003C\u002Fp>\u003Cp>For public service accounts, a strong and unique password, two-step verification, and regular bill checking are important. Users should monitor credit, bank, and public account activities against misuse of official identity information.\u003C\u002Fp>\u003Ch2>Record Control and User Action\u003C\u002Fh2>\u003Cp>LeakData check indicates whether the queried email address is present in this record. A positive result does not necessarily mean that all data fields definitely belong to that user; however, it is a sufficient warning for precautionary measures. A negative result only indicates that there is no match in this dataset and does not eliminate the possibility of appearing in other breaches.\u003C\u002Fp>\u003Cp>A positive result indicates that the e-mail address is present in the eThekwini Municipality eServices records. Due to the context of official identification, billing, and password, it requires high-priority security and identity protection action.\u003C\u002Fp>","eThekwini Municipality Data Breach (81.8 Thousand Reported Records)","eThekwini Municipality Data Breach. 81.8 Thousand reported records were reported. Reported data: Dates of birth, Deceased date, Email addresses. Review the…","\u002Fuploads\u002Flogo\u002Feservices_durban_gov_za.webp",false,{"name":41,"sector":42,"country":43,"website":10,"websiteArchiveUrl":16,"websiteStatus":16,"websiteCheckedAt":20},"eThekwini Municipality","Government \u002F Municipality","South Africa"]