Bootlegger data leak exposes franchisee contact details

Bootlegger has taken a legacy operations dashboard offline after it exposed business information and contact details belonging to franchisees, operators and managers. The South African coffee franchise said it would notify the Information Regulator and was contacting those affected, following the disclosure reported by MyBroadband on 16 October 2026.

What was exposed

MyBroadband reported that the dashboard appeared to be protected by a login screen, but sent information to visitors before they had logged in. That information was visible in the webpage’s source, meaning the presence of a login screen did not prevent access to the underlying data.

The publication said it verified that the exposed material included names and contact information linked to 132 Bootlegger locations, alongside some performance and financial data. That figure describes locations represented in the exposed information, rather than a confirmed count of currently trading outlets.

In its subsequent response, Bootlegger confirmed that certain information on the legacy platform had not been protected by its login. Chief executive Ricky Ruthenberg identified the material as business performance data, café pipeline information, Google listing details and business contact information.

The contact details included franchisee and operator names and email addresses, as well as general manager names and mobile numbers.

The dashboard’s address reportedly became visible through photographs of laptop screens posted by employees on Instagram. An anonymous poster on the MyBroadband forums and Reddit disclosed the issue, which the publication then investigated.

Bootlegger’s response and timeline

Ruthenberg said Bootlegger became aware of a potential data concern on the afternoon of Thursday, 15 October 2026. The affected platform was a legacy version of BOS, an internal operations dashboard previously used for café support scheduling, trade reporting, store visit reports and action item management.

According to Ruthenberg, the company’s IT and governance teams acted immediately, and the legacy platform was taken fully offline that day. MyBroadband also reported that the application, hosted on Railway, was taken down after it approached the company for comment.

Bootlegger said it had already migrated BOS to a secure environment. However, historical information remained on the older platform because its decommissioning had not been completed.

“No customer data was collected on this platform, and customers are therefore not at risk,” Ruthenberg said.

He added that, at the time of the response, there was no evidence that Bootlegger’s databases or core business systems had been accessed. The company’s IT teams were continuing their review to confirm that position. This was an initial assessment, not a statement that the review had concluded.

AI development claims and the confirmed weakness

The initial disclosure linked the dashboard to experimentation with AI-assisted software development, often described as “vibe-coding”. MyBroadband’s first report said Ruthenberg appeared to have encouraged or directly developed an internal dashboard using Claude.

Those development claims should be distinguished from the access-control problem confirmed in Bootlegger’s response. The company acknowledged that information on the legacy platform was not protected by its login; its explanation focused on historical data left behind after migration.

For the franchise community, the practical distinction matters. The reported failure was not simply that a dashboard address became public. It was that information could be retrieved without authentication, despite the page displaying a login screen.

Bootlegger’s account also puts the retirement of older systems in focus: moving operations to a replacement environment had not removed the historical information from the previous platform.

Notifications and practical next steps

Ruthenberg said Bootlegger would notify the Information Regulator in line with its obligations under the Protection of Personal Information Act, known as POPIA. He also said the company was contacting franchisees, operators and managers whose details were affected.

The announced notification and continuing technical review are separate steps. The response did not establish that the regulator notification had already been completed, nor did it present a final finding on access to core systems.

Practical takeaway: Franchise operators should ask which current and retired systems hold their contact and trading information, whether access controls have been independently checked, and who is responsible for confirming that old platforms and their data have been fully decommissioned.