A Canadian supermarket chain recently informed members of its loyalty program that their personal data was compromised in a cybersecurity incident. Save-On-Foods, a grocery retailer in Western Canada, detected unauthorized activity on one of its servers on October 13, which was promptly contained. Following this, the company engaged a cybersecurity specialist to investigate the breach.
Customers enrolled in the More Rewards program were notified via email about the incident. The email disclosed that unauthorized access had been gained to their names, addresses, phone numbers, email addresses, and dates of birth, if provided. When asked about the scale of the breach, Save-On-Foods did not provide specific numbers by the deadline.
The Pattison Food Group, the parent company of Save-On-Foods, states on its website that the More Rewards program boasts over 3.5 million members. To access online shopping services, customers are required to be registered in the More Rewards program, which also offers exclusive discounts at physical stores.
While the compromised data did not include credit card details or passwords, concerns were raised by the Canadian Centre for Cyber Security about the potential misuse of personal information in phishing attacks. Cybercriminals may exploit such data to deceive individuals into revealing sensitive information or making fraudulent transactions.
In response to the incident, Save-On-Foods emphasized that they would not solicit passwords, banking details, or other sensitive information from customers via communication channels. They also reassured customers that the relevant authorities and data protection regulators had been informed.
Reddit users in British Columbia and Alberta expressed frustration over the security implications of loyalty programs requiring personal information. Some users reported encountering issues when attempting to change their passwords following the breach notification. More Rewards members were advised to remain vigilant against suspicious communications and to avoid sharing sensitive information in response to unsolicited requests.
Efforts have been made to notify the appropriate authorities and privacy regulators about the breach. The Office of the Information and Privacy Commissioner for British Columbia was contacted for confirmation but did not respond before the article’s publication.