Shoprite recorded four data breaches affecting 44 customers in its 2026 financial year, even as the retailer handles thousands of loyalty-card transactions every minute and maintains financial accounts for more than 4.3 million customers.
The South African retail group identified information security and cyber risk as its top business risk in its 2026 integrated report. It also rated its cybersecurity controls “partially effective”, the weakest assessment among its six core business risks.
The report shows that data breaches at the retailer have increased for a second consecutive year, rising from one incident in 2024 to three in 2025 and four in 2026.
All four incidents in the latest financial year involved personally identifiable information. Shoprite reported that 44 customers were affected, compared with one customer in 2025. In 2024, a single breach affected 1,437 customers.
The company did not disclose how the latest incidents occurred.
Shoprite collects thousands of data points on loyalty members
Shoprite’s exposure to cyber risk is closely tied to the amount of customer information its digital services handle.
Its Xtra Savings loyalty programme accounts for more than 88.7% of sales and processes over 2,500 card swipes per minute. The group also holds more than 5,000 data points per loyalty programme member, according to its report.
The programme gives the retailer information it can use to understand shopping habits and personalise offers. But the same volume of customer information also makes protecting that data an important operational responsibility.
Shoprite’s digital services extend beyond grocery shopping. Its Money Market Account has more than 4.3 million customers, while its Sixty60 delivery business generated R25.5 billion in sales during the 2026 financial year.
A security incident involving these services could expose customer information, compromise intellectual property or disrupt operations. Shoprite identifies these consequences in its assessment of cybersecurity risk.
The company has also flagged increasingly sophisticated cybercrime and the wider use of artificial intelligence tools as factors that could make attacks more frequent or severe.
AI and a technology overhaul feature in Shoprite’s response
Shoprite is reorganising its approach to risk management, bringing risk, compliance, insurance, information security, and occupational health and safety functions together under one enterprise risk and compliance department.
The retailer is also looking at the dual role of artificial intelligence in cybersecurity. While it considers AI tools part of the changing threat landscape, its information and technology governance priorities include using technology to detect and counter threats more quickly.
The company’s board audit and risk committee has listed information security and cyber defence among its priorities for the 2027 financial year. It is also focused on establishing safeguards for the group’s use of AI, including protecting data and intellectual property.
Alongside these measures, Shoprite is upgrading its SAP S/4HANA systems across finance, data analytics and human resources, with completion targeted for 2029. The project forms part of a wider technology modernisation programme.
Africa faces growing cybersecurity threats amid skills shortage
Shoprite’s cybersecurity challenges reflect a broader problem across Africa, where rising cyberattacks are exposing vulnerabilities in digital infrastructure and corporate information systems.
In May 2026, TechMedia Africa reported that South Africa’s internet infrastructure suffered a major distributed denial-of-service (DDoS) attack, disrupting web hosting, email and customer management services across some of the country’s largest network and hosting providers.
South Africa is not alone in facing growing cybersecurity threats.
In Kenya, the Communications Authority recorded 4.6 billion cyber threat events in the final quarter of 2025, representing a 441.3% increase from the preceding quarter.
The growing exposure to cyber threats comes amid a shortage of skilled cybersecurity professionals across the continent.
Research indicates that 82% of African organisations struggle to recruit qualified cybersecurity and artificial intelligence professionals, highlighting a critical skills gap as cybercrime losses across the continent were estimated at $5 billion in 2025.
The figures underscore the growing cybersecurity challenges facing African businesses as digital adoption expands and organisations handle increasingly large volumes of sensitive customer information.