Save-On-Foods owner Pattison says More Rewards loyalty database was accessed

TLDR

• Pattison says More Rewards loyalty data was accessed, confirmed on 16 October after unauthorised activity on a server.¹²³
• Names and, if provided, addresses, phone numbers, emails and birth dates were exposed; passwords and card data were not.¹²
• No affected count is given; the 3.5 million figure is programme membership, not victims.¹²

Save-On-Foods and its owner, Pattison Food Group, say they found unauthorised activity on one of their servers on 13 October and confirmed on 16 October that data in the More Rewards loyalty database was accessed.¹²³ The company says the data includes names and, if provided, addresses, phone numbers, email addresses and dates of birth, and that passwords, credit card data and transaction history were not accessed.¹² No count of affected customers has been given; CBC notes only that Pattison's website describes More Rewards as having more than 3.5 million members.¹²

Save-On-Foods emailed More Rewards customers on Friday 16 October, according to CBC, telling them their personal information was involved.¹ Global News quotes the company as saying "the More Rewards accounts themselves remain secure" and that nothing else was accessed "based on the information available to us".² The company statement describes the incident as quickly contained, and says it shut down the server, brought in a third-party cybersecurity expert and is notifying the appropriate authorities and privacy regulators.¹²³

More Rewards is used across Save-On-Foods, Buy-Low Foods, PriceSmart Foods and Nesters stores, and CBC says online shoppers at Save-On-Foods must have a profile.¹² None of the three outlets says who is behind the intrusion, how the server was accessed, or whether any ransom or leak-site claim exists.¹²³

Customers are advised to be cautious if contacted by anyone asking for sensitive information such as social insurance numbers or security-question answers, and not to click unverified links.³ CBC adds that the Canadian Centre for Cyber Security says exposed personal details can make phishing more convincing.¹

Why it matters: the exposed fields are the ones scammers use to impersonate a retailer, and the number of affected members has not been disclosed for a program that Pattison describes as covering over 3.5 million people.¹²