Shoprite invests in privacy protection startup after customer data hack
South African grocery giant Shoprite Group has announced it is investing in secure data collaboration platform Omnisient, a few months after it suffered a hack that led to the auction of customers’ personal information on the dark web.
The retailer is among a group of companies, led by Buffet Investments and KLT, which have partaken in an undisclosed expansion round in the company, described as Africa’s first “privacy-preserving data collaboration platform provider”.
“We are excited by local start-ups that are creating value for our customers and partner businesses whilst having privacy at the core of their offering,” said ShopriteX strategy and innovation chief Neil Schreuder.
“As a data-rich organisation, this investment will enable us to deepen our knowledge and understanding of our customers and their needs so that we can continue to expand on the relevant services we offer them.”
Shoprite said it has been working with Omnisient for the past year.
It said the company’s technology allows businesses to use consumption data in a secure, compliant and risk-free manner to create new revenue streams.
“Thanks to their bank-grade encryption technology, customers’ data is anonymised and protected at all times. Personally-identifiable information is also never shared.”
“In partnership with Omnisient, Shoprite will be able to use customer data to better understand and identify opportunities to create more value and improve financial inclusion for its customers.”
Aside from Buffet Investments and KLT, One5, ENL, Investec, and Nedbank have invested in Omnisient.
Omnisient co-founder and CEO, Jon Jacobson, said the investment would be used to support the company’s continued geographic expansion and ongoing development of the platform into the world’s leading source of consumer intelligence that fully complies with global consumer privacy regulations.
Editorial credit: Fela Sanu / Shutterstock.com
Shoprite fell prey to a cyber extortion gang in early June 2022.
It said that some customers’ names and ID numbers were “potentially leaked”, specifically those who used Shoprite’s money transfers to and within Eswatini, Namibia, and Zambia.
The group claiming responsibility for the attack — RansomHouse — said Shoprite had left its customers’ data in its Fica database unprotected.
“It’s been quite some time since we encountered something that outrageous,” the group said.
“Their staff was keeping enormous amounts of personal data in plain text [and] raw photos packed in archived files, completely unprotected.”
It threatened to sell the data and leak a portion online unless Shoprite paid a ransom.
To prove their claims, RansomHouse uploaded 365 files to their dark web website containing customers’ personal information.
The data in the sample was 400MB when compressed, while the group said it had downloaded 600GB of files from Shoprite.
Shoprite declined to deal with the attackers, and RansomHouse announced on 20 July that the stolen database had been “partially sold” after “long and hot negotiations”.
Now read: Security products to protect websites against DDoS attacks
Loading ...