Save-On-Foods said a cybersecurity incident discovered on Oct. 13 exposed personal information linked to its More Rewards loyalty program, including members’ names, addresses, phone numbers, email addresses and birth dates.
What Save-On-Foods said and what was exposed
Save-On-Foods said it found unauthorized activity on one of its servers on Oct. 13, quickly contained the incident and investigated with the help of a cybersecurity expert. In notices sent to customers, the company said the compromised data included names, addresses, phone numbers, email addresses and birth dates that members had provided. Based on the information available, Save-On-Foods said more sensitive information, including passwords or credit card details, was not accessed.
Save-On-Foods requires customers to join More Rewards for online shopping, and the same program used for in-store discounts also collects the personal information tied to those conveniences. The company warned that customers should stay alert for suspicious calls or messages after the breach.
Why loyalty program data remains valuable to scammers
Pattison Food Group says More Rewards has over 3.5 million members. Even without passwords or payment card data, a breach affecting a program of that size “can still pose serious risks if criminals use personal details to craft convincing phishing attempts.”
Richard Frank, director of Simon Fraser University’s international cybercrime center, said scammers can still get significant value from loyalty-program records because “loyalty programs usually provide enough details to make realistic scams.” He added that “most of these break-ins are opportunistic” and that attackers often gain access after employees click malicious links or download malware; once inside, criminals can “map the network” and “identify what they can steal to monetize.”
What Save-On-Foods is advising customers
Save-On-Foods told More Rewards members it will not send messages requesting passwords, banking details, payment information, social insurance numbers or answers to security questions. The company said it has notified the appropriate authorities and privacy regulators. Requests for confirmation from the Office of the Information and Privacy Commissioner for B.C. received no response before publication.
