A cybersecurity incident at Save-On-Foods exposed personal details tied to its More Rewards loyalty program, the company said. The compromised information included members’ names and any addresses, phone numbers, email addresses and birth dates they had provided.
Save-On-Foods said it found unauthorized activity on one of its servers on Oct. 13, had the incident “quickly contained,” and then investigated with help from a cybersecurity expert.
What the Save-On-Foods breach exposed
The company’s notices to customers listed names, addresses, phone numbers, email addresses and birth dates as the data involved. Save-On-Foods also said that “based on the information available,” more sensitive information, including passwords or credit card details, was not accessed.
Because Save-On-Foods requires customers to join More Rewards for online shopping, the loyalty program used for in-store discounts also holds the personal information tied to those conveniences.
Risks and scale
Save-On-Foods had not provided a figure for the number of affected customers by the time of publication. According to The Pattison Food Group, More Rewards has over 3.5 million members, and a breach affecting a program of that size can enable convincing phishing attempts even without passwords or payment card data.
Simon Fraser University international cybercrime centre director Richard Frank said scammers can still get significant value from loyalty-program records because “loyalty programs usually provide enough details to make realistic scams.” He emphasized that “most of these break-ins are opportunistic” and that attackers often gain access after employees click malicious links or download malware; once inside, criminals can “map the network” and identify what they can steal to monetize.
Company actions and advice
Save-On-Foods told More Rewards customers to stay alert for suspicious calls or messages. The company said it will not send messages requesting passwords, banking details, payment information, social insurance numbers, or answers to security questions.
Save-On-Foods also said it notified the appropriate authorities and privacy regulators. A request for confirmation to the Office of the Information and Privacy Commissioner for B.C. received no response before publication.
