Bob Shop has notified customers that it suffered a data breach which may have allowed an unauthorised party to access their credit card number and expiry date.<\/p>\n\n\n\n
An email signed by Bob Group CEO Anita Erasmus stated the unauthorised party gained access to parts of Bob Group\u2019s systems, including Bob Shop\u2019s database, between 30 and 31 October 2026.<\/p>\n\n\n\n
The affected Bob Shop database contains customer and seller accounts, as well as older partial payment records, Erasmus said.<\/p>\n\n\n\n
\u201cAll identified access routes have been closed, and the last recorded activity was on 1 November 2026,\u201d she said.<\/p>\n\n\n\n
\u201cWe are treating this as if this information was accessed, although not all users may have had their information accessed.\u201d<\/p>\n\n\n\n
Erasmus said that since their investigation was ongoing, they did not currently know who the responsible party was. Bob Group has reported the matter to the Information Regulator, as required by law.<\/p>\n\n\n\n
Card information, including the cardholder name, card number, and expiry date, may have been exposed by the breach.<\/p>\n\n\n\n
\u201cThe card number was stored in encrypted form, but the encryption key was also copied, so the card number should be treated as exposed. The record does not contain the card security code (CVV),\u201d Erasmus said.<\/p>\n\n\n\n
The unauthorised party could also access the Bob Shop database, which holds customer account details, including names, email addresses, usernames, and passwords.<\/p>\n\n\n\n
\u201cPasswords are stored in scrambled (hashed) form. We have no evidence that your account details were read, but we cannot rule it out,\u201d Erasmus said.<\/p>\n\n\n\n
Bob Group warned that information could be used to attempt fraudulent purchases, particularly online, or to make phishing messages look more convincing.<\/p>\n\n\n\n
\u201cYour account details could be used to try to log in to Bob Shop or, if you use the same password elsewhere, to other websites,\u201d the email stated.<\/p>\n\n\n\n
Erasmus said that Bob Group has removed historical card numbers, names and expiry dates from the live Bob Shop database, and replaced the encryption key.<\/p>\n\n\n\n
\u201cWe informed our acquiring bank, which was asked to notify the card schemes, so that card issuers can monitor for fraud,\u201d she said.<\/p>\n\n\n\n
\u201cWe also closed the routes the unauthorised party used, ended all active sessions and replaced the passwords, keys and system credentials that were exposed.\u201d<\/p>\n\n\n\n
In addition, Bob Group implemented more stringent approval processes for all payouts and held every change to payout bank details until it was confirmed.<\/p>\n\n\n\n
It has also preserved the evidence for the investigation, notified the Information Regulator and our banking partners, and started further security improvements across all Bob Group systems.<\/p>\n\n\n\n
Bob Shop advised customers to check their card statements and report any transaction they do not recognise to their bank immediately.<\/p>\n\n\n\n
\u201cNever share your card security code (CVV), one-time PIN (OTP) or banking password with anyone who contacts you,\u201d it continued.<\/p>\n\n\n\n
\u201cAdditionally, change your Bob Shop password and, if you use the same password on other websites, change it there too.\u201d<\/p>\n\n\n\n
Bob Group warned customers to be wary of emails, SMS messages, and calls purporting to be from the company.<\/p>\n\n\n\n
\u201cWe will never ask you for your password, card number, card security code (CVV), one-time PIN (OTP) or banking log-in details, and we will never ask you to change bank details by email.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"
Bob Shop notified customers that its parent company Bob Group’s systems were accessed by an unauthorised party and credit card details and exposed. User account information may also have been accessed.<\/p>\n","protected":false},"author":15,"featured_media":677552,"comment_status":"open","ping_status":"closed","sticky":true,"template":"","format":"standard","meta":{"_sma_x_autopost_status":"posted","_sma_x_autopost_error":"","_sma_x_post_id":"2120858914191282634","_sma_facebook_post_id":"120850204637381_1559807446171233","_sma_instagram_post_id":"17991370776118452","_sma_threads_post_id":"18128132549286093","_sma_x_attempts":1,"footnotes":""},"categories":[27],"tags":[67063,81364,83647],"class_list":["post-677551","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-anita-erasmus","tag-bob-group","tag-bob-shop"],"_links":{"self":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/677551"}],"collection":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/users\/15"}],"replies":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/comments?post=677551"}],"version-history":[{"count":2,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/677551\/revisions"}],"predecessor-version":[{"id":677591,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/677551\/revisions\/677591"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media\/677552"}],"wp:attachment":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media?parent=677551"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/categories?post=677551"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/tags?post=677551"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}