A prominent Canadian grocery chain has informed participants in its loyalty program that their personal details were compromised in a cyber breach. Save-On-Foods, a grocery retailer in Western Canada, detected unauthorized activity on one of its servers on October 13, which was promptly contained. Following this, they initiated an investigation with a cybersecurity specialist and subsequently sent an email to More Rewards customers on Friday.
The email informed recipients that their names, and potentially their addresses, phone numbers, email addresses, and dates of birth were accessed during the breach. Although the exact number of affected customers was not disclosed by Save-On-Foods, the parent company, Pattison Food Group, states on its website that the More Rewards program boasts over 3.5 million members.
Save-On-Foods mandates that online shoppers be enrolled in the More Rewards program, which offers exclusive in-store discounts to its members. The email reassured customers that, based on available information, no other sensitive data such as credit card details or passwords were compromised.
Despite this, the Canadian Centre for Cyber Security cautioned that cybercriminals could exploit personal information from breaches to enhance phishing attacks. Criminals often exploit corporate networks through employees clicking on malicious links or downloading malware, enabling them to access and exploit loyalty program details for fraudulent schemes.
The incident prompted a mixed response from various online communities, with numerous Reddit users expressing concerns over the disclosure of personal information through loyalty programs. Some users reported encountering errors when attempting to change their passwords following the notification.
Save-On-Foods advised More Rewards members to remain vigilant against suspicious communications and assured them that the company would never request passwords, banking details, or other sensitive information. They also confirmed that they had informed relevant authorities and privacy regulators about the breach, although the Office of the Information and Privacy Commissioner for B.C. did not respond to CBC News inquiries before the article’s publication.