Brief
Shoprite flags cybersecurity as top risk amid rising data breaches
The retailer says its controls are only partially effective and residual risk remains medium.
By Felo News Desk · Published
Shoprite Group has placed cybersecurity at the top of its risk register, rating the controls protecting it against cyberattacks as "partially effective," the weakest rating among its six core business risks, according to the company's 2026 integrated report.
The retailer recorded four data breaches in FY2026, up from three in FY2025 and one in FY2024. All four incidents involved personally identifiable information and affected 44 customers. By contrast, FY2025 saw a single customer affected, while FY2024’s breach impacted 1,437 customers. The report does not detail the incidents, despite a stated zero‑tolerance policy for security breaches.
Shoprite rates the inherent cyber risk as critical; even after accounting for controls, the residual risk remains medium. All other core risks – such as technology system unavailability, logistics breakdowns, regulatory non‑compliance, stock losses, and weak internal financial controls – score higher on control effectiveness and retain a low residual risk.
The company warns that the rise of AI tools and the growing sophistication of cybercrime increase the likelihood of more frequent and severe incidents. A breach could expose sensitive data or intellectual property and significantly disrupt operations, the report adds.
Shoprite’s data exposure potential is considerable. Its Xtra Savings loyalty programme processes more than 2,500 card swipes per minute and accounts for over 88.7% of sales, with each member holding more than 5,000 data points. The group also operates a Money Market Account serving over 4.3 million customers, and its on‑demand delivery service Sixty60 generated R25.5 billion in sales in FY2026.
Technology availability is the next highest risk on the register. The unavailability of key systems – whether due to service‑provider failures, cloud outages, server crashes or telecom disruptions – is rated a critical inherent risk, with a tolerance of 99% availability during operating hours and 95% outside them. Controls for this risk are deemed substantially effective.
Shoprite has reorganised its risk‑management approach to address these challenges, though the integrated report notes that the overall risk trend for cybersecurity is unchanged from the prior year.
Key facts
- Shoprite rates cybersecurity controls as only partially effective, the weakest among six core risks. (techcentral.co.za)
- Four data breaches were recorded in FY2026, affecting 44 customers. (techcentral.co.za)
- The Xtra Savings loyalty programme handles over 2,500 card swipes per minute and stores more than 5,000 data points per member. (techcentral.co.za)
- Shoprite’s Money Market Account serves more than 4.3 million customers. (techcentral.co.za)
- Residual cyber risk is rated medium despite critical inherent risk. (techcentral.co.za)
Sources
- [1] techcentral.co.za — originally reported as “Shoprite ranks cybersecurity as its number one risk”
