Top South African e-commerce platform suffers data breach which includes users’ credit card details
Bob Shop has notified customers that it suffered a data breach which may have allowed an unauthorised party to access their credit card number and expiry date.
An email signed by Bob Group CEO Anita Erasmus stated the unauthorised party gained access to parts of Bob Group’s systems, including Bob Shop’s database, between 30 and 31 October 2026.
The affected Bob Shop database contains customer and seller accounts, as well as older partial payment records, Erasmus said.
“All identified access routes have been closed, and the last recorded activity was on 1 November 2026,” she said.
“We are treating this as if this information was accessed, although not all users may have had their information accessed.”
Erasmus said that since their investigation was ongoing, they did not currently know who the responsible party was. Bob Group has reported the matter to the Information Regulator, as required by law.
Card information, including the cardholder name, card number, and expiry date, may have been exposed by the breach.
“The card number was stored in encrypted form, but the encryption key was also copied, so the card number should be treated as exposed. The record does not contain the card security code (CVV),” Erasmus said.
The unauthorised party could also access the Bob Shop database, which holds customer account details, including names, email addresses, usernames, and passwords.
“Passwords are stored in scrambled (hashed) form. We have no evidence that your account details were read, but we cannot rule it out,” Erasmus said.
Bob Group warned that information could be used to attempt fraudulent purchases, particularly online, or to make phishing messages look more convincing.
“Your account details could be used to try to log in to Bob Shop or, if you use the same password elsewhere, to other websites,” the email stated.
Erasmus said that Bob Group has removed historical card numbers, names and expiry dates from the live Bob Shop database, and replaced the encryption key.
“We informed our acquiring bank, which was asked to notify the card schemes, so that card issuers can monitor for fraud,” she said.
“We also closed the routes the unauthorised party used, ended all active sessions and replaced the passwords, keys and system credentials that were exposed.”
In addition, Bob Group implemented more stringent approval processes for all payouts and held every change to payout bank details until it was confirmed.
It has also preserved the evidence for the investigation, notified the Information Regulator and our banking partners, and started further security improvements across all Bob Group systems.
Bob Shop advised customers to check their card statements and report any transaction they do not recognise to their bank immediately.
“Never share your card security code (CVV), one-time PIN (OTP) or banking password with anyone who contacts you,” it continued.
“Additionally, change your Bob Shop password and, if you use the same password on other websites, change it there too.”
Bob Group warned customers to be wary of emails, SMS messages, and calls purporting to be from the company.
“We will never ask you for your password, card number, card security code (CVV), one-time PIN (OTP) or banking log-in details, and we will never ask you to change bank details by email.”
Loading ...