Bob Shop data breach: card numbers exposed. What customers should do
Bob Shop says card numbers and expiry dates of customers who paid by card should be treated as exposed after a breach on 30 and 31 October. CVVs were not taken. Here's what to do.
Bob Shop says customers who paid by card should treat their card number and expiry date as exposed after an attacker got into its systems on 30 and 31 October 2026 (TechCentral). The online marketplace, formerly Bidorbuy, told customers on 12 November to check their card statements and change their Bob Shop password (MyBroadband).
What was taken in the Bob Shop breach?
Bob Group, which runs Bob Shop, said the attacker reached the database holding customer and seller accounts and "older partial payment records". The last recorded activity was on 1 November (TechCentral).
The card numbers were encrypted, but the encryption key was also copied, which is why the company says they should be treated as exposed (MyBroadband).
| Information | Status, according to Bob Group |
|---|---|
| Cardholder name | May have been exposed |
| Card number | Treat as exposed (encryption key also copied) |
| Card expiry date | May have been exposed |
| Card security code (CVV) | Not in the records |
| Name, email address, username | Could be reached, no evidence it was read |
| Password | Stored in hashed (scrambled) form, could be reached |
Source: MyBroadband, TechCentral
The company says not every user's information may have been accessed, but it is treating the data as if it was (MyBroadband).
Who is affected?
The notice went to buyers who paid by card (TechCentral). Bob Shop has not said how many people are affected or who was behind the attack, and its investigation is ongoing (MyBroadband).
Seller accounts were also in the breached database. The notice doesn't say whether any seller payouts were affected (TechCentral).
What should Bob Shop customers do now?
Bob Shop's own advice to customers is (MyBroadband):
- Check your card statements and report any transaction you don't recognise to your bank straight away.
- Change your Bob Shop password, and change it on any other site where you used the same password.
- Never share your CVV, one-time PIN (OTP) or banking password with anyone who contacts you.
- Be wary of emails, SMS messages and calls claiming to be from Bob Shop.
Bob Group warned that the information could be used for fraudulent purchases, especially online, or to make phishing messages look more convincing (MyBroadband).
How do I spot a fake Bob Shop message?
Bob Shop says it will never ask for your password, card number, CVV, OTP or banking login details, and will never ask you to change bank details by email (MyBroadband). Any message asking for these is not from Bob Shop.
What has Bob Shop done about it?
According to the company (TechCentral):
- It removed historical card numbers, names and expiry dates from the live database on 1 November and replaced the encryption key.
- It closed the routes the attacker used, ended all active sessions and replaced exposed passwords, keys and system credentials.
- It added stricter approval for payouts and is holding every change of payout bank details until it is confirmed.
- It reported the breach to the Information Regulator, as Popia requires, and told its acquiring bank, which was asked to notify the card schemes so card issuers can watch for fraud.
FAQ
Was my CVV stolen in the Bob Shop breach?
No. Bob Group says the exposed card records do not contain the card security code (CVV), but card numbers, names and expiry dates should be treated as exposed.
When did the Bob Shop breach happen?
An unauthorised party accessed Bob Group's systems on 30 and 31 October 2026, and the last recorded activity was on 1 November. Customers were notified on 12 November.
Should I cancel my card?
Bob Shop advises checking your card statements and reporting any transaction you don't recognise to your bank immediately. Your bank can advise whether to replace your card.
Will Bob Shop contact me for my details?
Bob Shop says it will never ask for your password, card number, CVV, OTP or banking login, and will never ask you to change bank details by email.