← Pick n Pay

2026 Pick n Pay — legacy Bottles/Asap! app breach; Capitec urges card replacement

2026 Unknown records affected Share on X

Data compromised

Per Pick n Pay: names, emails, phone numbers, delivery addresses, encrypted passwords, credit card type, last four digits, and expiry dates—not full PANs or valid CVV codes; Capitec Bank notified a subset of customers in July 2026 to replace cards after card metadata exposure

Technical writeup

Verified incident — March–July 2026 reporting window. Pick n Pay online executive Enrico Ferigolli confirmed a data breach involving customer information from a legacy on-demand platform first known as Bottles and later Pick n Pay Asap!, affecting users who registered before 2022 on a system since overhauled in 2025. Exposed fields include names, email addresses, phone numbers, delivery addresses, encrypted passwords, credit card type, last four digits, and expiry dates; Pick n Pay states full card numbers and valid CVV codes were not exposed despite a CVV column placeholder in the dataset. A threat actor marketed the database on Breach Forums; forensic investigation into the source remained ongoing at catalog time and Pick n Pay had not published a total victim count. In July 2026 Capitec Bank—South Africa's largest bank by customer base—began notifying a small subset of Capitec cardholders that their card details were exposed via the Pick n Pay app breach, waiving card replacement fees and recommending proactive card replacement even without observed unauthorized activity. BreachHistory indexes recordsAffected 0 pending attested population totals.

Root cause

Data breach of customer information from a decommissioned legacy on-demand delivery platform (Bottles, later Pick n Pay Asap!) used before 2022; separate from the current Asap! system overhauled in 2025

References