I've been mildly following this story. The guy reports an issue even which a child can replicate and which Google has already indexed but supposedly gets charged for hacking.
http://mybroadband.co.za/vb/showthread.php/553957-City-of-Joburg-security-issue-everyone-can-see-all-customers-statements/page26
http://www.reddit.com/r/technology/comments/1kv8mb/guy_informs_city_of_johannesburg_coj_about_a/
http://mybroadband.co.za/vb/showthread.php/553957-City-of-Joburg-security-issue-everyone-can-see-all-customers-statements/page26
http://www.reddit.com/r/technology/comments/1kv8mb/guy_informs_city_of_johannesburg_coj_about_a/