eGauteng Business

We've been tracking a recent uptick in South African government-related data appearing on underground forums, often linked to misconfigured cloud storage or poorly secured APIs. What caught our attention with the **eGauteng Business** leak wasn't the size – roughly **400MB** – but the apparent recency and specificity of the data. This wasn't a dusty archive; it appeared to contain records updated as recently as late **2023**, offering a potentially current snapshot of business registrations and related personal information within the **Gauteng province**. The setup here felt different because the data wasn't just a generic dump; it was structured and well-organized, suggesting a targeted extraction rather than a simple scraping operation.

### eGauteng Business Data Leak: Exposing Business and Personal Data

The data leak from **eGauteng Business**, an online portal for registering and managing businesses within the Gauteng province of South Africa, has exposed a significant amount of sensitive information. We first identified the leak on a popular dark web forum known for hosting and indexing compromised databases. The initial post advertised a "fresh" database dump from **eGauteng Business**, claiming it contained detailed records of registered businesses and their associated personnel. What made this stand out was not only the claim of recency but also the inclusion of fields suggesting direct access to the application's backend, potentially bypassing typical access controls. This matters to enterprises now because it highlights the continued vulnerability of government portals and the potential for attackers to leverage this data for identity theft, fraud, and targeted phishing campaigns. This breach also aligns with a broader threat theme of increasing attacks on government infrastructure targeting PII.

**Breach Stats:**

* **Total records exposed:** Estimated to be in the tens of thousands, based on file sizes and data density. A precise count is difficult without fully reconstructing the database.
* **Types of data included:** Business names, registration details, contact information (emails, phone numbers), physical addresses, and potentially identity numbers (ID numbers) of business owners and directors.
* **Sensitive content types:** PII (Personally Identifiable Information), business registration documents (potentially scanned copies), and user credentials (if stored in the database).
* **Source structure:** Appears to be a structured database export, possibly in **SQL** or a similar format, based on preliminary analysis of file headers.
* **Leak location(s):** Initially observed on a dark web forum; subsequently shared on a Telegram channel dedicated to data leaks.

### External Context & Supporting Evidence

While the eGauteng Business breach hasn't yet received widespread media coverage, similar incidents targeting South African government entities have been reported. For example, in **2021**, a significant data breach at the **Department of Justice and Constitutional Development** compromised personal information of millions of South Africans ([Source: *ITWeb*](https://www.itweb.co.za/content/KA3WwqlL87n7kjW4)). This incident underscores the ongoing challenges faced by South African government agencies in securing sensitive data. OSINT indicates chatter on Telegram channels suggesting the files were obtained using a "custom web scraper" designed to exploit a vulnerability in the eGauteng Business portal's API. One Telegram post claimed the files were "collected from devs testing an AI project".