A prominent Canadian supermarket chain has informed members of its loyalty program that their personal details were compromised in a cybersecurity breach. Save-On-Foods, a grocery chain in Western Canada, detected unauthorized activity on one of its servers on October 13, which was promptly contained before launching an investigation with a cybersecurity specialist. Subsequently, an email was sent to More Rewards customers on Friday, notifying them of the incident.
The email informed customers that their names, addresses (if provided), phone numbers, email addresses, and dates of birth were accessed. When contacted, Save-On-Foods did not disclose the exact number of customers affected by the breach. The Pattison Food Group, the owner of the grocery chain, states on its website that the More Rewards program boasts over 3.5 million members.
Save-On-Foods mandates that online shoppers must be enrolled in the More Rewards program, which also grants members exclusive in-store discounts. The email assured customers that, based on available information, no other personal data such as credit card details or passwords was compromised.
Regarding potential phishing risks, the Canadian Centre for Cyber Security warned that cybercriminals could exploit personal details to enhance phishing attacks, posing as reputable organizations to deceive individuals into divulging sensitive information or making monetary transfers. Criminals often infiltrate corporate networks by exploiting employees who inadvertently click on malicious links or download malware.
Personal information is commonly utilized by cybercriminals to impersonate companies in email scams or malicious links, enabling them to steal identities, banking data, or credit card information. This sensitive information can facilitate fraudulent purchases on online platforms and even cryptocurrency markets.
In response to the breach, numerous Reddit users in B.C. and Alberta communities expressed frustration with loyalty programs that require customers to provide personal information, citing concerns about data being sold and increasing vulnerability to cybercrime. Some users reported encountering errors when attempting to change passwords after receiving breach notifications.
More Rewards members are advised to remain cautious of suspicious calls or messages, as Save-On-Foods emphasized that they will never request passwords, banking details, or other sensitive information via communication channels. The supermarket chain also disclosed that it has notified relevant authorities and privacy regulators about the incident, although the Information and Privacy Commissioner’s Office for B.C. did not respond to CBC News inquiries before publication.