A major Canadian grocery chain has informed customers enrolled in its loyalty program that their personal data was compromised in a cyber breach. Save-On-Foods, a Western Canadian supermarket, detected unauthorized activity on one of its servers on October 13, swiftly containing the breach and initiating an investigation with cybersecurity experts. An email was subsequently dispatched to More Rewards program participants, notifying them of the incident.
The email informed recipients that their names, addresses (if provided), phone numbers, email addresses, and dates of birth were exposed. Although the exact number of affected customers remains undisclosed, the Pattison Food Group, the chain’s parent company, states on its website that the More Rewards program boasts over 3.5 million members.
While Save-On-Foods clarified that no further personal data, such as credit card details or passwords, was compromised, cybersecurity experts warn of potential phishing risks. Cybercriminals could leverage the stolen information to orchestrate convincing phishing attacks, posing as reputable organizations to deceive individuals into divulging sensitive data or making illicit payments.
Richard Frank, director of Simon Fraser University’s international cybercrime center, highlighted that cybercriminals often exploit personal information to craft authentic-looking scams through loyalty programs. This information could be utilized to perpetrate online fraud, including unauthorized purchases in e-commerce platforms and cryptocurrency markets.
Furthermore, community reactions on online platforms like Reddit indicate growing concerns about the privacy implications of loyalty programs requiring personal data. Some users reported encountering difficulties in changing their passwords following the breach notification. Save-On-Foods advised More Rewards members to remain vigilant against suspicious communications, emphasizing that the company would never request sensitive information like passwords or banking details through unsolicited messages.
In response to the breach, Save-On-Foods confirmed that it had notified relevant authorities and privacy regulators. However, inquiries to the Office of the Information and Privacy Commissioner for British Columbia regarding the incident remained unanswered at the time of publication.