By JD GLOBAL MEDIA
South Africa’s Shoprite Group has identified cybersecurity as its most significant business risk, warning that its controls against cyberattacks and data breaches remain only partially effective even as the retailer continues to expand its digital services.
The disclosure appears in the retailer’s 2026 integrated report, which places information security and cyber risk at the top of its list of six core business risks. The report also records an increase in data breaches for a second consecutive financial year, highlighting the growing challenge of protecting customer information across a large retail operation that increasingly relies on connected technology.
Shoprite recorded four data breaches during the 2026 financial year, compared with three in 2025 and one in 2024. All four incidents in the latest reporting period involved personally identifiable information, affecting 44 customers. The company did not publicly describe the individual incidents in the report.
The figures place renewed attention on the security of information held by major retailers, particularly as shopping, loyalty programmes, digital payments, delivery services and customer accounts become more closely connected.
For South African consumers, the development is significant because digital services are now part of everyday shopping. Customers increasingly use mobile applications, electronic vouchers, loyalty accounts and online delivery platforms to purchase goods and manage transactions. These services offer convenience, but they also create responsibilities for businesses that collect, process and store personal information.
Cybersecurity Moves To The Top Of Shoprite’s Risk Register
According to the 2026 integrated report, Shoprite considers information security and cyber risk a critical inherent risk. This rating reflects the potential seriousness of a threat before the company’s existing controls are taken into account.
After those controls are considered, the retailer rates its remaining exposure as medium. However, it assesses the effectiveness of its cybersecurity controls as only partially effective, making cyber risk the weakest-performing control area among its six core business risks.
The other risks identified by the group include the unavailability of key technology systems, failures in distribution centres and logistics, non-compliance with laws and regulations, stock losses, and weaknesses in internal controls over financial reporting.
Shoprite rates the controls for those other risks as substantially effective, with their remaining exposure assessed as low.
The distinction is important. A company may have policies, security tools and procedures in place while still recognising that those measures do not fully address the threats it faces. The retailer’s assessment indicates that cybersecurity requires particular attention compared with its other major operational risks.
The report does not suggest that Shoprite has lost control of its systems or that a major attack has necessarily taken place. Instead, it documents the company’s own assessment of its exposure and the effectiveness of its safeguards.
Cybersecurity risks can arise from different sources, including stolen login credentials, phishing messages, malicious software, weaknesses in applications, compromised third-party services and unauthorised access to sensitive information. The report points to the increasing sophistication of cybercrime and the expanding use of artificial intelligence as factors that may contribute to more frequent or more severe incidents.
The company also maintains a stated tolerance of zero for security breaches and unmitigated critical vulnerabilities. That standard sets a clear expectation for how the business wants its security environment to operate, even though its latest assessment acknowledges that existing controls are not yet fully effective.
Data Breaches Have Increased For Two Consecutive Years
The report’s figures show a rising number of recorded breaches over the three financial years covered.
Shoprite reported one breach in the 2024 financial year, three in 2025 and four in 2026. The latest total represents an increase from the previous year, although the company has not disclosed enough information in the report to establish the precise causes of the incidents or whether they shared a common source.
The number of affected customers has also varied significantly. One breach in 2024 affected 1,437 customers. In 2025, one customer was affected, while the four incidents recorded in 2026 affected 44 customers in total.
These figures demonstrate why the number of incidents alone does not tell the full story. A single breach can affect a large number of people, while several smaller incidents can involve fewer individuals. Both the frequency of breaches and the sensitivity of the information exposed matter when assessing the consequences for customers.
Shoprite’s report says all four breaches in the latest financial year involved personally identifiable information. Such information can include details that identify an individual directly or indirectly, although the report does not specify precisely which data fields were involved in these cases.
The absence of further incident-level details means it would be inappropriate to conclude that payment information, passwords, identity documents or other particular records were exposed. The published figures establish that personal information was involved, but they do not provide a complete account of the incidents.
For affected customers, the potential consequences of personal-data exposure depend on what information was compromised and how it might be used. Criminals may attempt to exploit exposed details through impersonation, targeted phishing or fraudulent requests for money. However, these are general risks associated with personal-data breaches and should not be interpreted as confirmation that such activity followed Shoprite’s reported incidents.
The increase nevertheless reinforces the importance of incident prevention, early detection, effective containment and clear communication when personal information is affected.
Why Retailers Hold Valuable Customer Information
Large retailers collect information through multiple interactions with customers. Loyalty programmes, digital accounts, online orders, delivery arrangements and payment-related services can all generate records that need to be stored, processed and protected.
Shoprite’s Xtra Savings loyalty programme illustrates the scale of its digital activity. The company’s integrated report says the programme records more than 2,500 card swipes per minute and accounts for more than 88.7% of sales. The group also says it holds more than 5,000 data points per member.
Those figures underline the volume of information associated with a modern loyalty programme. Such programmes can support rewards, promotions and personalised shopping experiences, but the information they collect also creates a responsibility to ensure that access is properly controlled and that data is handled for legitimate purposes.
Shoprite also operates a Money Market Account with more than 4.3 million customers. Its Sixty60 on-demand delivery service generated R25.5 billion in sales during the 2026 financial year, according to the report.
Each service has different operational requirements, but their increasing use of digital systems means that security cannot be confined to one department or one application. Customer accounts, internal databases, staff access, service providers and the systems supporting transactions can all form part of a connected technology environment.
This does not mean that every system is equally vulnerable or that the reported breaches originated from these services. Shoprite has not publicly linked the four incidents to any specific platform in the material disclosed in its integrated report.
The broader issue is that companies operating across many digital channels must understand where personal information is held, who can access it, how it moves between systems and what happens when an unexpected security event occurs.
A weakness in one area can have consequences beyond the original system if access controls and monitoring are insufficient. Retailers therefore need to assess not only individual applications but also the connections between their technology platforms and the outside organisations that help them operate.
Artificial Intelligence Adds To The Cybersecurity Challenge
Shoprite’s report identifies artificial intelligence and the growing sophistication of cybercrime as factors that could increase the frequency and severity of incidents.
AI can assist businesses with analysing large volumes of security information, identifying unusual activity and prioritising potential threats. It may help security teams recognise patterns that would otherwise be difficult to detect quickly.
At the same time, criminals can use increasingly sophisticated tools to produce convincing fraudulent messages, automate parts of their operations and adapt their tactics. This can make it more difficult for employees and customers to distinguish legitimate communications from attempts to steal information or obtain access to accounts.
The technology itself is not inherently malicious. Its impact depends on how it is developed, deployed and used. For organisations, the challenge is to take advantage of useful security applications while preparing for the possibility that attackers may also benefit from new capabilities.
A strong response requires more than purchasing software. Companies need clear access policies, timely security updates, staff training, effective monitoring and procedures for responding to suspected incidents. They also need to review whether their controls remain appropriate as their systems and digital services change.
Shoprite has identified cybersecurity posture hardening as one of its main focus areas in information and technology governance. The report also recognises that AI can amplify cyber threats while providing tools to detect and counter them more quickly.
The challenge for the retailer is therefore two-sided: it must reduce the opportunities available to attackers while ensuring that its own technology teams can identify and respond to emerging threats.
Technology Availability Is Another Critical Concern
Cybersecurity is not the only technology-related issue in Shoprite’s risk register.
The unavailability of key technology systems is also rated a critical inherent risk. The company identifies possible causes including service-provider failures, internet and cloud outages, server crashes and telecommunications disruptions.
A retailer depends on reliable systems to support transactions, inventory management, distribution, staff operations and customer services. If important platforms become unavailable, the effects may extend beyond the technology department to stores, warehouses, suppliers and customers.
Shoprite’s stated tolerance is 99% system availability during operating hours and 95% outside those hours. The company rates its controls for this risk as substantially effective.
The figures show that the retailer treats system reliability as a distinct risk alongside information security. A business can protect information from unauthorised access yet still experience disruption if systems fail. Conversely, systems may remain available while security weaknesses expose information to other threats.
Both areas therefore require attention, but they involve different operational questions. Cybersecurity focuses on protecting systems and information against malicious or unauthorised activity, while availability planning seeks to ensure that essential services remain accessible and can recover when disruptions occur.
For a retailer operating across a large network, this includes planning for outages, maintaining reliable infrastructure, managing service-provider relationships and ensuring that critical processes can continue or recover within acceptable periods.
Shoprite Restructures Its Risk Management Function
The integrated report also describes a change in the way the group manages risk.
Shoprite has combined its risk, compliance, insurance, information security, and occupational health, safety and fire risk teams within a single enterprise risk and compliance department under a chief risk and compliance officer.
The change brings several risk-related functions together within a broader management structure. It provides an organisational framework through which risks can be considered across the business rather than being treated only as isolated departmental issues.
The report’s comparison with the previous year indicates that risk management was organised differently in the 2025 reporting period. The group risk function was then led by a group risk manager, while information security was listed separately.
The new structure does not, by itself, prove that cybersecurity controls have improved or that future breaches will be prevented. Its effectiveness will depend on how responsibilities are assigned, how security findings are escalated, whether sufficient resources are available and how consistently agreed measures are implemented.
The board’s audit and risk committee, chaired by Linda de Beer, has identified information security and cyber defence among its priorities for the 2027 financial year. The committee is also focused on establishing guardrails around the group’s use of AI, including protecting data and intellectual property.
Shoprite’s chief technology officer, Chris Shortt, is identified in the report as the custodian of the group’s information and technology assets, operating under a board-approved charter and committee oversight.
These governance arrangements place cybersecurity within the wider responsibilities of the company’s leadership. They also reflect the reality that digital risk can affect customers, operational continuity, regulatory obligations and business performance.
A Major Systems Upgrade Is Planned For 2029
Shoprite’s technology programme also includes an upgrade to SAP S/4Hana in its finance, data analytics and people functions. Chief executive Pieter Engelbrecht says in the integrated report that the project is being implemented using specialist resources sourced globally, with completion targeted for 2029.
The project is another indication of the scale and complexity of the retailer’s technology environment. Large systems upgrades can involve changes to data structures, business processes, integrations and the way employees access information.
The company’s audit and risk committee is expected to oversee the implementation as part of its 2027 agenda.
Shoprite’s chief technology officer has also described modernising the group’s core SAP retail platform, which supports real-time inventory, as its largest technology project. That platform is distinct from the finance, analytics and people-functions upgrade described by the chief executive, although both illustrate the continuing importance of technology modernisation across the group.
Major technology programmes require careful management because new systems and connections can introduce operational challenges if changes are not properly tested and controlled. Effective planning typically involves access reviews, data protection measures, testing, continuity arrangements and clear accountability for decisions.
The report does not say that the SAP projects caused the recorded data breaches. The two issues should therefore be treated separately: the company has disclosed a cybersecurity concern and a significant modernisation programme, but it has not established a direct link between them.
What The Disclosure Means For Customers
The report provides consumers with a clearer view of how Shoprite assesses its cybersecurity exposure, but it does not establish that customers generally need to stop using the retailer’s services.
The disclosed breaches affected 44 customers in the 2026 financial year, and the company has not published detailed descriptions of the incidents in the report. There is consequently no basis in the disclosure alone to conclude that every customer account was affected or that a specific service is unsafe.
Customers can nevertheless take sensible precautions when using any digital retail or financial service. They should use unique passwords where accounts support them, avoid sharing one-time passwords or verification codes, and be cautious about messages that create urgency or ask them to disclose personal details.
Customers should also verify unusual requests through official channels rather than relying on telephone numbers or links contained in unexpected messages. If they suspect that an account has been accessed without permission, they should contact the relevant service provider promptly and follow its account-security guidance.
These steps do not replace a company’s responsibility to protect information. Businesses remain responsible for maintaining appropriate security controls, limiting access to personal data and responding properly when incidents occur.
For organisations holding customer information, transparent incident reporting can also help people understand what happened, what information may have been affected and what action they should take. The level of detail available in Shoprite’s integrated report is limited, so the document does not answer every question about the four reported incidents.
The Road Ahead For Retail Cybersecurity
Shoprite’s assessment highlights the growing importance of cybersecurity as retailers extend their digital operations. Loyalty programmes, delivery applications, customer accounts and technology-driven logistics can create value for both companies and consumers, but they also increase the importance of protecting information and maintaining reliable systems.
The retailer has identified cyber risk as its leading business risk, acknowledged that its controls are only partially effective and reported four personal-information breaches during the latest financial year. It has also set cybersecurity and cyber defence among its priorities for the year ahead.
The next test will be how the company translates those priorities into measurable improvements. Relevant indicators may include fewer security incidents, faster detection and containment, stronger protection of critical systems and clearer oversight of information security across the organisation.
The report does not promise that breaches will be eliminated, nor does it disclose a detailed timetable for every planned security improvement. It does, however, establish that cybersecurity remains an area where Shoprite believes further work is necessary.
As South African businesses continue to rely on digital services, the protection of customer information is becoming an essential part of maintaining trust. For Shoprite, the message in its latest report is clear: despite the scale of its retail operations and technology investments, cyber risk remains a priority that requires continued attention from management, the board and its technology teams.
Comments
Post a Comment