JD Group jdgroup.co.za JD Group data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
In May 2023, South African retailer JD Group announced a breach affecting online stores including Bradlows, HiFi Corp and Incredible. Over 520,000 unique customer records were exposed, with names, email and physical addresses, phone numbers and South African ID numbers.
View all 13,118 breaches- Breach date
- 31 May 2023
- Affected
- 521,878
- Data exposed
- Email addresses, Government issued IDs, Names, Phone numbers, Physical addresses
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
JD Group is a South African retailer. In May 2023 it announced a data breach that affected several of its online stores, including Bradlows, Everyshop, HiFi Corp, Incredible, Rochester, Russells and Sleepmasters. Have I Been Pwned counts over 520k unique customer records. MyBroadband reported the incident.
Sources checked: haveibeenpwned.com, mybroadband.co.za, consumer.ftc.gov
Last verified against the official page:
What was exposed
The records held names, email addresses, physical addresses, phone numbers and South African ID numbers. Have I Been Pwned lists no passwords.
What this lets criminals do
A national ID number is the serious part. Together with a name, address and phone number, it is the kind of detail used to impersonate someone when applying for credit, opening an account or taking over a phone number through a SIM swap. Even without that, a message that quotes your address and a store you shopped at looks real, which makes phishing and fake delivery or refund texts more convincing.
What to do
Watch your accounts and credit file for anything you didn't start, and be wary of calls or messages from someone claiming to be your bank, a retailer or your mobile provider. Ask your mobile provider and bank what extra protection they offer on your account.
What to do if you were in it
- 1
Expect phishing that mentions the breach
Scammers use leaked details like your address, phone number or ID number to sound convincing, and the FTC warns that they may pretend to be the breached company. Don't click links in messages about it. Contact the company through a phone number or website you already know. The FTC's breach guidance explains what to look for.
- 2
Watch your accounts and credit record
Check bank statements and your credit report for accounts you didn't open. If you find misuse, tell your bank and report it to your local police or your country's identity theft authority. In the US the FTC gives a recovery plan, and other countries have equivalents.
- 3
Protect your phone number
Ask your mobile provider whether it can add a PIN or extra checks before a SIM swap or number transfer. An exposed ID number and phone number are what scammers use for this.
- 4
Use unique passwords and two-factor login
No passwords were listed, but phishing built from this data often goes after logins. Use a unique password per site and turn on two-factor login on your email and banking accounts.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It checks breach databases for your email, phone and other details, and Serus keeps monitoring and alerts you when they show up in a new leak. It can't remove data from a breach, so the other steps still matter.
Frequently asked
Was I affected by the JD Group breach?
Search your email on Have I Been Pwned, which holds this breach. It matters if you shopped online with JD Group stores such as Bradlows, HiFi Corp or Incredible.
What was exposed?
Names, email addresses, physical addresses, phone numbers and South African ID numbers.
Which stores were affected?
Have I Been Pwned lists Bradlows, Everyshop, HiFi Corp, Incredible (Connection), Rochester, Russells and Sleepmasters.
Should I change my password?
Passwords aren't listed in this breach. Focus on the phishing and impersonation risk that comes with an exposed ID number.
Sources
- Have I Been Pwned: JDGroup
- Have I Been Pwned: JD Group Data Breach · haveibeenpwned.com
- mybroadband.co.za/news/security/494239-half-a-million-customers-hit-by-incredible-hifi-corp-and-everyshop-data-breach.html
- consumer.ftc.gov/consumer-alerts/2022/10/have-you-been-affected-data-breach-read
- IdentityTheft.gov · identitytheft.gov
Something wrong or out of date? Tell us and we'll re-check it.
