Save-On-Foods' loyalty program breach, day by day: what was taken, what wasn't, and the scam risk that follows. Western Canadian grocer Save-On-Foods says personal details from its More Rewards loyalty database were accessed. Here is how the week unfolded, what the company says was and was not exposed, and why the bigger risk now is convincing scam messages. Loyalty programs feel harmless. You trade a phone number and an email address for cheaper groceries. But this week shoppers at a major Western Canadian supermarket chain learned that the database behind those discounts had been accessed by someone who shouldn't have been there. How the week unfolded. Tuesday, october 13. Staff found unauthorized activity on one of the company's servers. According to the company, the server was shut down the same day and an outside cybersecurity firm was brought in to investigate. The company describes the incident as quickly contained. Friday, october 16. The company confirmed that customer information in the More Rewards database had been accessed and began emailing affected members. More Rewards is run by Pattison Food Group and covers its Save-On-Foods, Buy-Low Foods, PriceSmart Foods and Nesters stores. Anyone who shops online at Save-On-Foods has to be a member. Saturday, october 17, into the weekend. The story spread across Canadian outlets. The company says it has notified the relevant authorities and privacy regulators. It has not said how many members were affected; CBC asked and did not get a number by its deadline. CBC also noted posts on regional Reddit forums from members who said they hit an error when trying to change their passwords after receiving the notice. In the breach, and not in it. Accessed: member names and, where members had supplied them, mailing addresses, phone numbers, email addresses and dates of birth. Not accessed, based on what the company knows so far: More Rewards IDs, passwords, credit card data and purchase history. The company says the accounts themselves, and members' points, remain secure and that a password reset is not required. Why the follow-up messages are the real worry. A list of names, emails, phone numbers and birthdays is exactly what a scammer needs to make a fake "your points are expiring" text or a fake fraud-department call sound real. The Canadian Centre for Cyber Security makes that point about stolen personal information generally, and Richard Frank, who directs Simon Fraser University's international cybercrime centre, told CBC that loyalty programs usually hold enough detail to build realistic scams. The company says it will never contact members asking for passwords, verification codes, banking or card details, Social Insurance Numbers or security-question answers, and it is urging members to verify any unexpected request through contact details they already trust. What this means for your company. Many businesses guard payment data carefully and treat their marketing or loyalty list as low-risk. This incident shows why that list deserves real protection too: it is the raw material for phishing aimed at your customers under your name. Collect only the fields you actually use (does the program really need a birth date?), keep that database separated from the rest of the network and watched for unusual access, and have a plain-language customer notice and FAQ ready before you need one. Remind staff, too, that their personal accounts with breached retailers can become a route to convincing lures at work. Need help protecting the customer data in your loyalty, marketing or online-store systems? Reach out to Layer 7 Data Solutions to discuss how Layer 7 Data Solutions, LLC. has helped companies similar to yours.

Save-On-Foods loyalty program members had personal information accessed in cybersecurity breach. Names were accessed, possibly contact information and addresses, but no number on how many affected. Arden McLeod · CBC News · Posted: Oct 17, 2026 10:21 PM PDT | Last Updated: 12 hours ago Estimated 3 minutes A major Canadian supermarket chain has notified customers in its loyalty program that their personal information was accessed during a cybersecurity breach. The Western Canadian grocery chain Save-On-Foods says it discovered unauthorized activity on one of its servers on Oct. 13, which was "quickly contained" before launching an investigation with a cybersecurity expert. An email was then sent out to More Rewards customers Friday. "We are writing to let you know about an incident involving your personal information," the email read. Customers who received an email were told that their names and - if provided - addresses, phone numbers, email addresses and dates of birth were accessed. CBC News asked Save-On-Foods how many customers were affected in the data breach but did not receive a number by deadline. Save-On-Foods requires online shoppers to be signed up for the More Rewards program, which also offers members exclusive in-store discounts. The email said "based on the information available," no other personal information, such as credit card data or passwords, was accessed. Phishing concerns. However, the Canadian Centre for Cyber Security says personal information can be used by cybercriminals to make phishing attacks more convincing, impersonating trusted organizations to trick people into sharing sensitive information or sending money. "Most of these break-ins are opportunistic," wrote Richard Frank, director of Simon Fraser University's international cybercrime centre, in an email to CBC News. He said criminals often gain access to corporate networks through employees accidentally clicking malicious links or downloading malware. But that's when criminals can "map the network," identify whatever they can steal to monetize, "and loyalty programs usually provide enough details to make realistic scams." Frank explained that personal information is often used by cybercriminals to impersonate companies in emails requesting more information or containing malicious links, potentially allowing them to steal identities, banking information or credit card details. He said criminals can use that more sensitive information to make fraudulent purchases through online stores and even cryptomarkets. Community response. Numerous Reddit commenters on B.C. and Alberta sub-communities expressed frustration with discount systems that require customers to provide personal information through loyalty programs, arguing data like that can be sold corporately and makes them a target for cybercrime. Several of those subreddit posts suggest that customers who received the notification and then tried to change their passwords were met with a recurring error. More Rewards members are being told to be vigilant about suspicious calls or messages, as Save-On-Foods says it will not send any communications asking for passwords, banking information, payment information, social insurance numbers or security question answers. In an email to CBC News, Save-On-Foods said it notified the appropriate authorities and privacy regulators. CBC News reached out to the Office of the Information and Privacy Commissioner for B.C. to confirm whether it had been notified of the incident but did not hear back before publication. Associate Producer Arden McLeod, from Vancouver, is an associate producer with CBC News. He has a passion for community storytelling, local news, and reflecting the values of B.C. He graduated from the British Columbia Institute of Technology's broadcast and online journalism program. You can reach him at [email protected].