RansomHouse Breaks Into Shoprite, Africa's Largest Retailer To Get Customers’ Data

RansomHouse ransomware gang, has claimed responsibility for cyberattack on Shoprite, (photo: twitter @Shoprite_SA)

JAKARTA - A ransomware gang called RansomHouse has claimed responsibility for a cyber attack on Shoprite, Africa's largest retailer.

The attack, which Shoprite confirmed a week ago, compromised customer data in Eswatini, Namibia and Zambia. Shoprite said the data breach "included names and ID numbers but no financial information or bank account numbers."

In a message posted on the RansomHouse Telegram channel and seen by TechCrunch, the so-called plot to target the company with weak security claims to have obtained 600 gigabytes of data from Shoprite. They claim to have collected personal data that is "in plain text/raw photos packaged in archived files, completely unprotected."

The group also claims to have contacted Shoprite management for negotiations and hinted that they would sell the data and publish it if talks fail.

TechCrunch contacted Shoprite to confirm whether RansomHouse had been in contact with them, and to obtain more details including the number of customers affected by the attack. However, the online retailer declined to comment, referring to the statement they posted after the incident.

In a statement, Shoprite said an investigation was ongoing and had notified the information regulator at its headquarters in South Africa (SA).

"An investigation was launched immediately with forensic experts and other data security professionals to establish the origin, nature and scope of this incident," Shoprite said.

“Additional security measures to protect against further data loss have been implemented by changing the authentication process and fraud prevention and detection strategies to protect customer data. Access to the affected network areas has also been locked," Shoprite said, as quoted by Techcrunch.

The group urged affected customers to take precautions while saying they had not recorded any misuse or publication of data.

“The Group (Shoprite) is not aware of any misuse or publication of customer data that may have been obtained. However, web monitoring of the incident continues… it is possible that the affected customer data could be used by unauthorized parties," they said.

Shoprite is Africa's largest retail chain with 2.933 stores as of February this year. Their brands include Shoprite, Usave, LiquorShop, Checkers, Checkers Hyper and House & Home. The retailer had a strong financial performance with its operating profit increasing last year by 19% (in the financial year ended July 4) to 9.7 billion rand (IDR 10.1 trillion).