JD Group data breach

In May 2023, the South African retail conglomerate JD Group suffered a major data breach that exposed the personal information of over 520,000 unique customers across multiple online and physical retail brands.

Affected Brands

The incident impacted customers who shopped at or used online platforms for JD Group brands, including:

• Bradlows
• Everyshop
• HiFi Corp
• Incredible (Connection)
• Rochester
• Russells
• Sleepmasters

What Data Was Exposed

Leaked .csv files published by an online actor on a hacker forum revealed:

• Full names
• Email addresses and physical addresses
• Phone numbers
• South African ID numbers
• Dates of birth, gender, VAT numbers, and account creation dates
• Note: JD Group confirmed that banking details and financial data were not compromised in the attack.

JD Group Response and Customer Risks

• Regulatory Action: JD Group issued formal notifications under Section 22(b) of South Africa's Protection of Personal Information Act (POPIA).

• Security Advice: The company urged affected shoppers to remain vigilant against phishing attempts, social engineering, and fraudulent communications.

In order to protect yourself, we recommend the following:

1. Monitor your credit report for any suspicious activities. If you cannot do this yourself, make use of any service that does this on your behalf.

2. Be on the lookout for an increase in number of spam or scam calls and emails. We recommend you make use of Apps like True Caller, which can assist you in identifying any possible spam or scam calls.