South African Pick n Pay Shoppers Hit by Database Breach

HEROIC analysts found 93,581 records belonging to Pick n Pay customers after a database breach that surfaced on July 1, 2024. Pick n Pay is one of South Africa's largest retail chains, and its customer base represents everyday South African shoppers whose personal details and hashed login credentials are now circulating in threat actor networks. The breach exposed email addresses, phone numbers, usernames, first names, last names, and bcrypt password hashes. For South African consumers who rely on Pick n Pay's online platform for grocery shopping, loyalty programs, and in-store purchases, this incident carries a direct risk of account takeover and targeted fraud.

Why This Is Dangerous

This breach combines identity data with authentication credentials. While bcrypt hashing offers more resistance than weaker algorithms, hashed passwords are not safe once they leave the database. Attackers run offline brute-force and dictionary attacks against bcrypt hashes, and any user who chose a common or short password faces a real risk of having their credentials cracked. The presence of full names, phone numbers, and email addresses alongside those hashes means attackers have everything needed to profile victims, attempt account takeover, launch targeted phishing calls and SMS fraud, and build identity profiles for wider fraud operations.

What Was Exposed

• Email Address
• Phone Number
• Username
• First Name
• Last Name
• Password Hash (bcrypt)

Why This Matters

Retail customers whose data is exposed in database breaches face a convergence of risks: credential stuffing attacks on their Pick n Pay account and any other platform where the same password is reused, phishing calls and SMS scams exploiting their name and phone number, and identity theft schemes that combine full name, email, and phone data to pass identity verification checks at financial institutions. In South Africa, where mobile money and digital retail are expanding rapidly, phone number exposure is particularly dangerous because it can be used to intercept one-time passwords through social engineering attacks against mobile operators.

How Database Breaches Work

A database breach occurs when an attacker gains unauthorized access to a backend data store, typically through SQL injection, compromised administrative credentials, unpatched application vulnerabilities, or misconfigured cloud infrastructure. Retail platforms store large volumes of customer data across authentication, loyalty, and transaction systems. Once an attacker gains access to a customer database, they can export thousands or millions of records in a single operation. The exfiltrated data is then packaged and distributed through dark web forums and private channels, where it is used directly or sold to other criminal actors.

Check If You Are Affected

HEROIC's free breach scanner searches more than 400 billion compromised records to determine instantly whether your email address appears in known breach datasets, including this Pick n Pay incident. Run a free scan at heroic.com to find out if your information was exposed, and update your Pick n Pay password and any other accounts where you use the same credentials.