pnp.co.za Listed by apt73 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 9 January 2025, the South African retail website pnp.co.za was listed by the ransomware group apt73 as a victim of a data breach. Public reporting indicates that internal files were exfiltrated during a ransomware attack on Pick n Pay Group Ltd., the organisation behind the site. The number of people affected remains unknown, and further technical details about the intrusion have not been disclosed.

The listing itself is a claim by the group rather than independent confirmation of every asserted detail. For customers, staff and partners of a major supermarket chain, any confirmed exposure of internal material raises practical questions about what information may now be in unauthorised hands and what steps follow.

Inside the incident

According to the available record, pnp.co.za was publicly listed by apt73 on 9 January 2025. The sole description of the data involved is that internal files were allegedly exfiltrated in a ransomware attack. No figures have been released for the volume of data taken, the precise systems compromised, the initial access method, or the timeline of the intrusion. The number of individuals whose information may have been included is listed as unknown.

Ransomware incidents of this type typically involve encryption of systems combined with data theft, after which the operators demand payment and threaten to publish the stolen material if the demand is not met. In this case, only the fact of the listing and the statement that internal files were removed have been reported. Whether any ransom was paid, whether systems were restored from backups, or whether the group has released sample files remains undisclosed in the public record.

Who is apt73?

apt73 is a ransomware group that operates under a double-extortion model: after gaining access to a network it encrypts data and simultaneously copies files, then posts the victim’s name on a dedicated leak site. The group claims that failure to pay will result in public release of the stolen material. Like other ransomware operators, it has been observed targeting organisations across multiple sectors and geographies, using common initial-access techniques such as phishing, exploitation of unpatched remote-access services, or compromised credentials.

Public documentation of the group’s activity shows a pattern of listing corporate victims and, in some cases, publishing partial data dumps to increase pressure. For the pnp.co.za incident specifically, the only verified public statement is the group’s own listing; no independent forensic report claiming the full scope of the claim has been released. Statements made by apt73 about this victim should therefore be treated as claims pending further verification.

About pnp.co.za

pnp.co.za is the online presence of Pick n Pay Group Ltd., a major South African retailer. The group operates several supermarket and convenience brands, including Pick n Pay and Boxer, serving millions of customers across the country through physical stores and digital channels. As a large retail organisation it routinely processes customer loyalty data, payment information, employee records, supplier contracts and internal operational documents.

A breach affecting such an organisation is consequential because retail systems sit at the intersection of consumer trust, supply-chain logistics and financial transactions. Even when the exact contents of stolen files are not yet known, the mere possibility that internal material has left the organisation’s control can affect customer confidence, regulatory scrutiny and day-to-day operations.

What data was at risk

The public facts state only that internal files were exfiltrated. No inventory of specific data types—such as customer names, identity numbers, payment-card details, employee records or commercial contracts—has been published. Organisations of this size and sector typically hold large volumes of personal and commercial information, including loyalty-programme data, transaction histories, staff payroll details and supplier agreements. Because the precise contents remain unconfirmed, it is not possible to state with certainty which categories of data, if any, were included in the material claimed by apt73.

Until a fuller disclosure is made by the company or by independent investigators, any assumption about particular data elements would be speculative.

The real-world impact

For individuals, the principal risks associated with a retail ransomware incident of this kind are identity misuse, targeted phishing and, in some cases, financial fraud if payment or contact details were among the files taken. Even internal documents that do not contain personal data can be used by criminals to craft more convincing social-engineering messages. Because the number of people affected is unknown, anyone who has shopped with Pick n Pay brands, held a loyalty account or worked for the group should treat the possibility of exposure as real until more information emerges.

For the organisation itself, consequences can include operational disruption during recovery, regulatory notifications under South African data-protection law, potential contractual claims from partners, and longer-term reputational cost. Recovery from ransomware also frequently involves costly system rebuilds and heightened security investment. None of these outcomes has been confirmed as having materialised; they remain the ordinary range of risks that follow a claimed ransomware listing of this nature.

If your data was in this claimed breach

If you have used Pick n Pay services, held a loyalty card or been employed by the group, begin by monitoring bank and credit-card statements for unfamiliar transactions and treat unsolicited emails or calls that reference the company with caution. Change passwords on any accounts that reuse credentials associated with Pick n Pay services, and enable multi-factor authentication wherever it is offered. Consider placing a fraud alert with South African credit bureaux if you believe personal identifiers may have been involved.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets. Such a scan will not confirm or rule out involvement in this specific incident, but it can indicate whether your address has surfaced elsewhere and help you prioritise further protective steps while official details remain limited.

AICompiled with AI assistance from public sources and published under our editorial standards.