Retailer says only personal information and limited credit card information were compromised.
Retail giant Pick n Pay says it is “truly sorry” for the personal information that was compromised in the data breach of its old delivery platform, Bottles, but assured customers that the compromised data did not include customers’ full credit card numbers or the CVV numbers.
This is despite the data actors who obtained data from the breach claiming they are also selling “CVV” on the dark web.
“The data breach did not include full credit card numbers or the CVV,” Enrico Ferigolli, online executive at Pick n Pay, told The Citizen. “While the dark actors (those trying to sell it) show a data structure with a ‘CVV’ heading, there is no data stored in that field.”
Pick n Pay asap! was previously known as Bottles before its rebrand. The retailer confirmed a 2022 data breach of customer information from the Bottles platform.
The old version, Bottles, was decommissioned in 2025, and the current Pick n Pay asap! system requires customers to re-register for it, said Ferigolli.
Pick n Pay investigates data breach
Ferigolli said the retailer does not have the number of customers affected by this breach, but all customers who were on the Bottles platform database by the end of 2022 have been informed.
“We have notified the regulator and customers potentially impacted – we don’t know the exact number, but as a precaution (while the investigation is underway), we notified all customers in the database as of the end of 2022.”
Regarding information obtained, Ferigolli said the retailer does not store information such as customers’ full credit card numbers or CVVs; these are managed by payment security providers.
Data obtained from old Pick n Pay platform
Ferigolli said information obtained may include customer names, usernames, email addresses, mobile numbers, dates of birth, delivery addresses, Smart Shopper numbers where linked, and encrypted passwords.
He noted that while the data obtained may also include the type of credit card, the last four digits of the credit card number and an expiry date, fraudulent use of cards isn’t possible as full credit card numbers or CVV security codes were not compromised.
“Full payment card data is managed by accredited payment security providers in line with strict industry standards and compliance requirements, supported by regular independent audits,” said Ferigolli.
“Without these full details, the credit card cannot be used to directly process fraudulent card transactions. South African ID numbers were also not stored on the Bottles platform.”
‘We are still working to determine the source’
He said they initiated a forensic investigation with an independent cybersecurity firm on Wednesday after becoming aware that customer data was being sold on the dark web.
“At this stage, the forensic investigation is ongoing, and we are still working to determine the source, but there is no evidence of unauthorised access to the decommissioned platform,” said Ferigolli.
“While the data involved is more than four years old and some customer details may no longer be current, we strongly advise customers to remain vigilant against unsolicited calls, messages or emails, avoid sharing passwords or one-time PINs, and change passwords on any other platforms where the same credentials may have been used.”
No worries for new platform
Ferigolli assured customers who use the Pick n Pay asap! platform that there is nothing to worry about, as the platform operates on a new system.
“Customer information on the current Pick n Pay application remains secure. asap! operates on a new and separate infrastructure from the decommissioned infrastructure, and as part of this, we have already completely overhauled our approach to data security.
“We continue to review our architecture and security measures, including how we manage and retain historical customer data, expand monitoring, and invest in the latest security technology.”
Retailer apologises
“We’d like to assure you that no full payment card information was exposed, and the data cannot be used to directly process fraudulent card transactions,” said Ferigolli.
“But other personal data from four years ago was indeed exposed, and for that we are truly sorry.”
He added that the retailer is taking this “extremely seriously, and our immediate priority is ensuring customers have clear information about what has happened, what it means for them in practical terms, what we are doing about it, and how they can protect themselves.
“We are working closely with cybersecurity specialists and undertaking a broader review of historical data management and retention practices as part of our ongoing investment in customer data security.”