Simple mistake caused one of South Africa’s fastest-growing coffee brands to expose company and private data

Bootlegger Coffee Company recently exposed sensitive company information, including franchisees’ personal data, in what has become a cautionary tale about the careless use of AI.

Founded in Cape Town in 2012 by three best friends, Pieter Bloem and brothers De Waal & Antonie Basson, Bootlegger is one of the fastest-growing coffee brands in South Africa.

After noticing a lack of decent coffee places open before 06h30 for their early-morning cycling routines, the three attempted to launch their own coffee venture.

The friends bought a small coffee shop called Go Gos, which they later rebranded as Bootlegger, inspired by the rebellious nature of 1920s-era America.

The company has seen massive growth, increasing from 18 locations in 2019 to 86 stores in September 2025, a 378% increase in six years.

The company also opened its first international outlet in Windhoek last year, and hit 100 stores before the end of 2025.

The stores are supported by a micro-roastery that processes 400 tonnes of coffee annually. The chain’s workforce stands at 3,500.

Ricky Ruthenberg, the CEO, joined soon after the company was founded. In July 2026, he wrote on LinkedIn that he had delved into “vibe-coding” every night for several weeks.

Vibe-coding refers to using AI to write computer programs without necessarily reviewing or understanding the underlying software code.

One Monday morning after a weekend of vibe-coding, Ruthenberg said he mandated Claude to the 15 people who directly report to him.

They developed a full AI adoption plan and, within 6 weeks, produced something he said blew him away. Ruthenberg said Bootlegger operations would never be the same.

“Software companies have long tried to own their ecosystem and lock you in, making integrations expensive and almost impossible. AI has completely levelled that playing field,” he said.

“The value going forward sits in the data they hold of yours and the way they translate it and the services around it they offer, but software itself will soon become free, I am almost certain.”

Bootlegger became a cautionary tale for AI in South Africa

Ruthenberg’s enthusiasm has become a cautionary tale about the pitfalls of vibe-coding and unsupervised AI-driven development.

In October, people in South Africa’s technical community saw that Bootlegger employees had published photos on Instagram which showed the web address to what looked like an internal dashboard.

While it was secured by a login screen which required a username and password, the application unfortunately preloaded a huge amount of sensitive data that was not password-protected.

This data was not displayed, but someone with a little technical knowledge could easily access it, or even use AI to bypass the login screen and view parts of the dashboard.

Based on how the dashboard looked and the fact that it seemed to date back to July, when Ruthenberg made the LinkedIn post, people in South Africa’s technology industry believed it was vibe-coded.

MyBroadband verified that the exposed data included the names and contact information of franchisees and managers at 132 Bootlegger locations. Some performance and financial data was also leaked.

In response to a request for comment from MyBroadband, Bootlegger did not confirm or deny whether the web application was vibe-coded.

Instead, Ruthenberg told MyBroadband it was a legacy version of an internal application they call BOS, which contained outdated data.

“It is an internal operations dashboard which was previously used for café support scheduling, trade reporting, store visit reports, and action item management,” he explained.

Ruthenberg assured that no customer data was collected on the BOS platform, and that customers were therefore not at risk.

“As part of its ongoing security measures, Bootlegger had already migrated BOS to a secure environment,” he said.

“However, historical data remaining on the legacy platform had not yet been fully decommissioned, and it is this information that was exposed.”

He confirmed that some business performance data, café pipeline information, Google listing details, and business contact information were not protected by the application’s login page.

The business contact information in question included franchisee and operator names and email addresses, as well as general manager names and mobile numbers.

“To date, there is no evidence that Bootlegger’s databases or core business systems were accessed. The company’s IT teams are continuing their review to confirm this,” Ruthenberg said.

He said that Bootlegger would notify the Information Regulator about the data exposure in line with its obligations under the Protection of Personal Information Act.

Bootlegger would also contact the franchisees, operators and managers whose details were affected by the leak.