Shoprite rates cybersecurity controls as only partially effective

• 

  Shoprite rated its cybersecurity controls as only “partially effective” in its 2026 integrated report, the weakest control rating among its six core business risks.

• 

  Information security, including cyber risk, was ranked first, with an inherent risk rated critical and a residual risk rated medium.

• 

  The retailer recorded four data breaches in FY2026, up from three in FY2025 and one in FY2024.

• 

  All four FY2026 breaches involved personally identifiable information and affected 44 customers.

• 

  Shoprite says its risk trend is unchanged, while the report cites increasingly sophisticated cybercrime and the rise of AI tools as factors that may make incidents more frequent and severe.

Who

Shoprite Group, the South African retailer.

What

It rated its cybersecurity controls “partially effective” and reported four data breaches in FY2026.

When

The disclosure was in Shoprite’s 2026 integrated report; the breaches were recorded in FY2026.

Where

Not stated

Why

The report says the rise of AI tools and the growing sophistication of cybercrime make more frequent and severe incidents more likely.

This story does not have two clearly opposing sides.