According to TechCentral, Shoprite has graded its cybersecurity, the controls protecting it against cyberattacks and data breaches, as only “partially effective”, the weakest rating it gives any of its six core business risks. The retailer’s own figures show data breaches rising for a second year in a row. The disclosure is in Shoprite’s 2026 integrated report, which places information security, including cyber risk, first on its list of core risks.
Shoprite rates the inherent risk, the threat before any safeguards are applied, as critical. Even after its controls are taken into account, the residual risk is still rated medium. None of the other five core risks scores worse than “substantially effective” on controls, and all five are left with a low residual risk. They are the unavailability of key technology systems, breakdowns in distribution centres and logistics, non-compliance with laws and regulations, stock losses, and weak internal controls over financial reporting.
Breaches are rising
Shoprite recorded four data breaches in FY2026, up from three in FY2025 and one in FY2024. All four involved personally identifiable information, and 44 customers were affected. In FY2025 only one customer was affected; in FY2024 a single breach affected 1 437 customers. The report does not describe the incidents. That is against a stated tolerance of zero: Shoprite’s risk register sets “zero tolerance for security breaches and unmitigated critical vulnerabilities” as the threshold for this risk.
The report says the rise of AI tools and the growing sophistication of cybercrime make more frequent and severe incidents more likely, and that a breach could expose sensitive data or intellectual property and significantly disrupt operations. It marks the risk trend as unchanged on the prior year.
The amount of data at stake is considerable. Shoprite’s Xtra Savings loyalty programme records more than 2 500 card swipes a minute and accounts for more than 88.7% of sales, and the group says it holds more than 5 000 data points per member. Shoprite also runs a bank account: its Money Market Account has more than 4.3 million customers. Sixty60, its on-demand delivery service, generated R25.5bn in sales in FY2026.
How Shoprite is responding
Shoprite has reorganised how it manages these risks. It has merged its risk, compliance, insurance, information security, and occupational health, safety and fire risk teams into a single enterprise risk and compliance department under a chief risk and compliance officer. In its 2025 report, the risk function was run by a group risk manager, with information security listed separately. “Cybersecurity posture hardening” is named among the main focus areas of the year, and the report says AI both amplifies cyberthreats and offers tools to detect and counter them more quickly.
The board’s audit and risk committee, chaired by Linda de Beer, lists information security and cyber defence among its priorities for FY2027, alongside building guardrails around the group’s use of AI, including protection of data and intellectual capital. The report names Shoprite’s chief technology officer as custodian of all the group’s information and technology assets. That is Chris Shortt, who said on TechCentral’s Meet the CIO podcast last month that cybersecurity is the one area that keeps him awake at night.
The next big project
The report also puts a date on Shoprite’s next big systems project. Group CEO Pieter Engelbrecht writes that the group is implementing an upgrade to SAP S/4Hana in its finance, data analytics and people functions, using “top-tier globally sourced resources”, with completion targeted for 2029. Oversight of the implementation is on the audit and risk committee’s agenda for FY2027. Shortt told TechCentral that modernising Shoprite’s core SAP retail platform, which carries the group’s real-time inventory, is the largest technology project it has running.
Read more about similar risk disclosures in the Tech & Telco section.
More from Shoprite’s 2026 integrated report: Shoprite adds prepaid airtime and vouchers to Sixty60 app; Shoprite seeks shareholder approval for six-year CEO share plan worth R170 million.
