Bob Shop Customers Told to Treat Card Details as Exposed After Breach
Bob Shop Customers Told to Treat Card Details as Exposed After Breach
Bob Group, the operator of the online marketplace Bob Shop, has instructed customers to treat their credit and debit card details as compromised following a cybersecurity breach. The company confirmed that attackers accessed its databases in late October, copying both encrypted card numbers and the encryption keys necessary to decrypt them, rendering the data vulnerable.
Bob Group, the parent company of the online marketplace Bob Shop, has instructed customers to treat their credit and debit card details as compromised following a cybersecurity breach that exposed both encrypted card numbers and the keys required to decrypt them.
In a notice emailed to customers on Thursday and reviewed by TechCentral, the company disclosed that an "unauthorised party" gained access to parts of its systems on October 30 and 31. The intrusion allowed the attacker to reach the Bob Shop database containing customer and seller accounts, as well as "older partial payment records." The last recorded unauthorized activity occurred on November 1.
The exposed card records included cardholders’ names, card numbers, and expiry dates. While the card numbers were stored in encrypted form, the company confirmed that the encryption key was also copied. "The card number should be treated as exposed," the notice stated. The records did not include card security codes (CVVs).
The attacker also accessed account details, including names, email addresses, usernames, and passwords. Bob Group noted that while the last stored passwords were in hashed form, there was no evidence they had been read, though the company could not rule out the possibility.
Bob Group has reported the breach to the Information Regulator, as required by the Protection of Personal Information Act (Popia). The company also notified its acquiring bank, which has been asked to alert card schemes so that card issuers can monitor for fraud.
The notice was signed by Anita Erasmus, the information officer who became CEO on September 1, succeeding co-founder Andy Higgins. Bob Group was formed in 2022 through the merger of auction site Bidorbuy and logistics software firm uAfrica.
On November 1, Bob Group removed historical card numbers, names, and expiry dates from the live database and replaced the encryption key. The company also closed the routes used by the attacker, ended all active sessions, and replaced exposed passwords, keys, and system credentials. Additionally, it implemented more stringent approval processes for payouts and is holding every change of payout bank details until confirmed.
The notice was sent to buyers who paid by card but did not specify whether any seller payouts were affected. The company stated it does not yet know who was responsible for the breach.
O.Somerville--NG
