MyBroadband reported on 16 October that coffee franchise Bootlegger exposed internal company and franchisee data through a web dashboard. It is worth being precise about what happened, because the detail is the useful part.
This was a data exposure found by people looking at it, not a break-in. The dashboard was hosted on a public platform and presented a login screen. But the page was sending a significant amount of data to the browser along with that login screen, so the information was readable in the page source by anyone who had the URL. No password was needed and nothing had to be defeated.
MyBroadband verified that the exposed information included names and contact details linked to 132 Bootlegger locations, along with some performance and financial data. According to the anonymous person who disclosed it, the dashboard was found because staff had posted photos of their laptop screens on Instagram with the URL visible.
The company response
Bootlegger chief executive Ricky Ruthenberg said the company became aware of the issue on the afternoon of 15 October 2026 and took the platform offline the same day. He described it as a legacy version of an internal operations dashboard that had already been migrated to a secure environment, with historical data left behind on the old platform that had not been fully decommissioned.
He stated that no customer data was collected on the platform and that customers are therefore not at risk, and that there is no evidence so far that Bootlegger’s databases or core business systems were accessed. The company said it will notify the Information Regulator in line with its POPIA obligations and is contacting the franchisees, operators and managers whose details were affected.
The suggestion that the dashboard was AI-built came from the anonymous discloser. Ruthenberg’s statement does not address it, and we would not present that part as established.
Three things worth taking from it
1. Authentication is not authorisation
A login form controls what the interface shows you. It does not, by itself, control what the server sends. If data is serialised into the page before the server has checked who is asking, the login is decoration. This is a specific, testable thing: load a protected page while logged out and read the raw response.
2. An unlisted URL is a public URL
Internal tools accumulate on public hosting because it is the quickest way to get something in front of colleagues. The address feels private because nobody has shared it. Then it turns up in a screenshot, a support ticket, a browser history sync or a referrer header. Obscurity has never been a control and it is a worse one every year.
The structural fix is to stop exposing internal tools to the internet at all. With Cloud29 ZTNA, an internal dashboard is reachable only by the people and devices you name. There is no public URL to find, no login page for a scanner to meet, and no dependence on the application having got its own authorisation checks right. That last point is the one that matters here, because it holds regardless of who or what wrote the code.
3. Decommissioning is part of the project
By the company’s own account the data had already been migrated somewhere secure. What caused the exposure was the old copy nobody switched off. A migration is only finished when the thing you migrated away from is gone, and that is the step most likely to be left for later.
The POPIA angle
This incident involved business contact details rather than consumer records, and Bootlegger has said it is notifying the Information Regulator anyway. That is the right instinct. Under POPIA the duty to notify is triggered by reasonable grounds to believe personal information has been accessed by an unauthorised person, and the business contact details of named individuals are still personal information.
If you are not certain your own internal tools would survive this test, that uncertainty is itself the finding. Talk to us and we will go through them with you.
Sources: MyBroadband, 16 October 2026 and the company response.