Shoprite has graded the controls protecting it against cyberattacks and data breaches as only “partially effective”, the weakest rating it gives any of its six core business risks. Its own figures show data breaches rising for a second year in a row.
The disclosure is in the retailer’s 2026 integrated report, which places information security, including cyber risk, first on its list of core risks. Shoprite rates the inherent risk as critical. Even after its controls are taken into account, the residual risk is still rated medium.
None of the other five core risks scores worse than “substantially effective” on controls, and all five are left with a low residual risk. They are the unavailability of key technology systems, breakdowns in distribution centres and logistics, non-compliance with laws and regulations, stock losses, and weak internal controls over financial reporting.
Shoprite recorded four data breaches in FY2026, up from three in FY2025 and one in FY2024. All four involved personally identifiable information, and 44 customers were affected. In FY2025, only one customer was affected; in FY2024, a single breach affected 1 437 customers. The report does not describe the incidents.
That is against a stated tolerance of zero. Shoprite’s risk register sets “zero tolerance for security breaches and unmitigated critical vulnerabilities” as the threshold for this risk.
The report says the rise of AI tools and the growing sophistication of cybercrime make more frequent and severe incidents more likely, and that a breach could expose sensitive data or intellectual property and significantly disrupt operations. It marks the risk trend as unchanged on the prior year.
Huge volume of data to protect
The amount of data at stake is considerable. Shoprite’s Xtra Savings loyalty programme records more than 2 500 card swipes a minute and accounts for more than 88.7% of sales, and the group says it holds more than 5 000 data points per member. Shoprite also runs a bank account: its Money Market Account has more than 4.3 million customers. Sixty60, its on-demand delivery service, generated R25.5-billion in sales in FY2026.
Technology takes the next slot on the risk register, too. The unavailability of key technology systems, whether through service-provider failures, internet and cloud outages, crashed servers or telecoms disruptions, is rated a critical inherent risk. Shoprite’s tolerance is 99% availability during operating hours and 95% outside them, and it rates those controls substantially effective.
Shoprite has reorganised how it manages these risks. It has merged its risk, compliance, insurance, information security, and occupational health, safety and fire risk teams into a single enterprise risk and compliance department under a chief risk and compliance officer. In its 2025 report, the risk function was run by a group risk manager, with information security listed separately.
“Cybersecurity posture hardening” is named among the main focus areas of the year in the report’s section on information and technology governance, which also says AI both amplifies cyberthreats and offers tools to detect and counter them more quickly.
The board’s audit and risk committee, chaired by Linda de Beer, lists information security and cyber defence among its priorities for FY2027, alongside building guardrails around the group’s use of AI, including protection of data and intellectual capital.
The report names Shoprite’s chief technology officer as custodian of all of the group’s information and technology assets, under a board-approved charter and the committee’s oversight. That is Chris Shortt, who said on TechCentral’s Meet the CIO podcast last month that cybersecurity is the one area that keeps him awake at night.
Big SAP migration
The report also puts a date on Shoprite’s next big systems project. Group CEO Pieter Engelbrecht writes that the group is implementing an upgrade to SAP S/4Hana in its finance, data analytics and people functions, using “top-tier globally sourced resources”, with completion targeted for 2029. Oversight of the implementation is on the audit and risk committee’s agenda for FY2027.
Shortt told TechCentral that modernising Shoprite’s core SAP retail platform, which carries the group’s real-time inventory, is the largest technology project it has running. – © 2026 NewsCentral Media
