Save-On-Foods has notified members of its More Rewards loyalty program that personal information was accessed in a cybersecurity breach. The Western Canadian grocery chain says it discovered unauthorized activity on one of its servers on Oct. 13, which was “quickly contained” before the company launched an investigation with a cybersecurity expert. An email was sent to More Rewards customers on Friday.
“We are writing to let you know about an incident involving your personal information,” the email said. It told recipients that names and, where provided, addresses, phone numbers, email addresses and dates of birth were accessed. The company said that, “based on the information available,” no other personal information, such as credit card data or passwords, was accessed.
Save-On-Foods did not provide a figure for how many customers were affected when asked by reporters. The Pattison Food Group, which owns the grocery chain, says the More Rewards program has more than 3.5 million members. Save-On-Foods requires online shoppers to be signed up for the More Rewards program, which also offers members exclusive in-store discounts.
Save-On-Foods response and advice
More Rewards members were advised to be vigilant for suspicious calls or messages. Save-On-Foods said it will not send communications asking for passwords, banking information, payment information, social insurance numbers or answers to security questions. The company also said it has notified the appropriate authorities and privacy regulators. Requests for confirmation to the Office of the Information and Privacy Commissioner for B.C. were not answered before publication.
Security and phishing risks
The Canadian Centre for Cyber Security warns that personal information can be used by criminals to make phishing attacks more convincing, impersonating trusted organizations to trick people into sharing sensitive information or sending money. Richard Frank, director of Simon Fraser University’s international cybercrime centre, said: “Most of these break-ins are opportunistic.” He added that criminals often gain access to corporate networks through employees accidentally clicking malicious links or downloading malware. “But that’s when criminals can “map the network,” identify whatever they can steal to monetize, “and loyalty programs usually provide enough details to make realistic scams,” Frank said.
Frank explained personal information is often used to impersonate companies in emails requesting more information or containing malicious links, potentially allowing criminals to steal identities, banking information or credit card details. He said they can then use more sensitive information to make fraudulent purchases through online stores and cryptomarkets.
Community reaction included frustration on regional subreddit communities in B.C. and Alberta about discount systems that require customers to provide personal information. Several subreddit posts suggested that some customers who received the notification and tried to change their passwords encountered a recurring error. Some More Rewards users reported a recurring error when attempting to reset their passwords after receiving the notice.
