We inform all relevant institutions of any vulnerabilities we find, and in most cases give them sufficient time to address the issues before we disclose them publicly. We never exploit the vulnerabilities for our own benefit.
But sometimes a system bug is so bad that it brings to light fraud or gross incompetence. We believe it is right to then go public with what we find immediately. This is the case with Sassa's Social Relief of Distress SRD grant system.
When we uncovered the problems described here, we did try to alert Sassa but found it near-impossible to get hold of anyone. Most of the contact numbers listed on its website either do not exist, or ring indefinitely.
We would have considered this a mere bug, informed Sassa and given them an opportunity to fix the problem before disclosing it. Except we discovered a bigger problem.
We found that 74 931 SRD grant applications were made for people born in February 2005. According to Statistics South Africa as of 2020 there were 82 097 births in February 2005. This would mean that the application rate is roughly 91. It is extremely unlikely that so many applications were made by people born in this month.
