Save-On-Foods Says More Rewards Customer Information Accessed in Cybersecurity Breach
Sarah Desjardins
10/19/20262 min read
Save-On-Foods is warning customers to remain alert for suspicious messages after personal information belonging to members of its More Rewards loyalty program was accessed during a cybersecurity breach.
The Western Canadian grocery chain said it discovered unauthorized activity on one of its servers on Oct. 13.
According to the company, the activity was “quickly contained,” and Save-On-Foods subsequently launched an investigation with the assistance of a cybersecurity expert.
Customers affected by the incident began receiving notification emails Friday.
“We are writing to let you know about an incident involving your personal information,” the company told recipients.
Names and Contact Information Accessed
Save-On-Foods said the information accessed included customers’ names.
Depending on what information individual members had previously provided, the affected data may also have included home addresses, telephone numbers, email addresses and dates of birth.
The company has not publicly disclosed how many customers were affected.
Pattison Food Group, which owns Save-On-Foods, says the More Rewards program has more than 3.5 million members.
Membership in the program provides customers with rewards and exclusive discounts, and Save-On-Foods requires customers shopping online to have a More Rewards account.
The company said that, based on its investigation so far, no other personal information such as credit card details or account passwords was accessed.
Stolen Data Could Be Used in Phishing Attempts
Although payment information was not believed to have been compromised, cybersecurity experts warn that names, contact information and other personal details can still be valuable to criminals.
The Canadian Centre for Cyber Security says personal information can be used to make phishing attempts appear more credible.
Those scams often involve criminals impersonating familiar companies or organizations and attempting to convince victims to provide additional sensitive information, send money or click malicious links.
Richard Frank, director of Simon Fraser University’s international cybercrime centre, said many corporate breaches are opportunistic rather than highly targeted.
“Most of these break-ins are opportunistic,” Frank said.
He said attackers can sometimes gain access when an employee clicks a malicious link or unintentionally downloads malware.
Once inside a corporate network, criminals may attempt to identify information that can be stolen and monetized.
Frank said loyalty-program databases can be particularly useful because they may contain enough personal information to make fraudulent messages appear legitimate.
That information could then be used in emails or other communications impersonating a company and asking customers for passwords, banking details or other sensitive information.
Customers Report Password-Change Problems
The breach has also prompted discussion among customers online.
Commenters in B.C. and Alberta Reddit communities expressed frustration about loyalty programs that require customers to provide personal information in exchange for discounts or other benefits.
Some users also reported experiencing errors when attempting to change their More Rewards passwords after receiving the breach notification.
Save-On-Foods has told customers to remain cautious about unexpected calls, emails or text messages following the incident.
The company says it will not contact customers asking them to provide passwords, banking details, payment information, social insurance numbers or answers to security questions.
Customers who receive messages requesting that type of information are being advised to treat them with suspicion.
Authorities and Privacy Regulators Notified
Save-On-Foods said it has reported the cybersecurity incident to the appropriate authorities and privacy regulators.
The company has not disclosed further details about how the unauthorized access occurred, how long the server may have been compromised or whether the information has been used for fraudulent purposes.
The full number of More Rewards members whose information was accessed also remains unclear.
For customers who received a notification, the immediate concern is the possibility that exposed personal details could be used in convincing phishing or impersonation attempts in the weeks or months ahead.
News
Stay updated with the latest BC news stories, subscribe to our newsletter today.
SUBSCRIBE
© 2026 Innovatory Labs Inc. All rights reserved.
LINKS