Bob Shop has told customers that an unauthorised party reached parts of Bob Group's systems, including the Bob Shop database, on 30 and 31 October 2026. Card details and account records were in that database.
What happened
In a notice signed by Bob Group CEO Anita Erasmus, the company said the affected database holds customer and seller accounts plus older partial payment records. Cardholder name, card number and expiry date may have been exposed. The card number was stored encrypted, but the encryption key was copied in the same intrusion, so the company is telling customers to treat the number as exposed. Card security codes were not stored.
Account data including names, email addresses, usernames and hashed passwords was also in reach. Bob Group says all identified access routes are closed, the last recorded intruder activity was 1 November, and the incident has been reported to the Information Regulator. Historical card numbers, names and expiry dates were removed from the live database, the encryption key was replaced, active sessions were ended and exposed credentials were rotated. Payout approvals were tightened and changes to payout bank details are now held until confirmed.
The company has not named the attacker and says its investigation is ongoing.
Who is affected
- Bob Shop buyers and sellers whose accounts existed at the end of October 2026.
- Anyone with an older order history on the platform, because the exposed records include partial payment data from previous years.
- Users who reused their Bob Shop password on email, banking or other shopping sites.
- Other South African retailers holding the same legacy pattern: encrypted card numbers whose key sits on the same server as the ciphertext.
What to do now
If you hold a Bob Shop account, change that password, change it anywhere it was reused, and read your card statements for October and November line by line.
- Report unrecognised card transactions to your bank and ask for the card to be replaced rather than only monitored.
- Expect convincing phishing that quotes your real name, email and order history, because those fields were in the database.
- If you sell on Bob Shop, verify your payout bank details are unchanged and query any alteration with Bob Group directly.
- For businesses: find every system that stores card numbers and confirm the key is not stored alongside them, because that design turns one database read into a full card exposure.
What this means for South African businesses
Under POPIA this is a notifiable compromise, and the regulator's record of more than 8,000 breach reports shows how routine that notification has become. The lesson for local SMEs is narrower than the headline: encrypting a card field is worthless if the key lives on the same host, and an attacker who reads the database reads both.
Small online stores are the most likely to repeat this mistake, because shared hosting and quick payment-plugin setups rarely separate keys from data.
Source: MyBroadband.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.