Save-On-Foods’ Loyalty Program Breach, Day by Day: What Was Taken, What Wasn’t, and the Scam Risk That Follows
Western Canadian grocer Save-On-Foods says personal details from its More Rewards loyalty database were accessed. Here is how the week unfolded, what the company says was and was not exposed, and why the bigger risk now is convincing scam messages.
Loyalty programs feel harmless. You trade a phone number and an email address for cheaper groceries. But this week shoppers at a major Western Canadian supermarket chain learned that the database behind those discounts had been accessed by someone who shouldn’t have been there.
This timeline draws on CBC News’ reporting on the breach, the company’s own incident update page and Global News.
How the week unfolded
Tuesday, October 13
Staff found unauthorized activity on one of the company’s servers. According to the company, the server was shut down the same day and an outside cybersecurity firm was brought in to investigate. The company describes the incident as quickly contained.
Friday, October 16
The company confirmed that customer information in the More Rewards database had been accessed and began emailing affected members. More Rewards is run by Pattison Food Group and covers its Save-On-Foods, Buy-Low Foods, PriceSmart Foods and Nesters stores. Anyone who shops online at Save-On-Foods has to be a member.
Saturday, October 17, into the weekend
The story spread across Canadian outlets. The company says it has notified the relevant authorities and privacy regulators. It has not said how many members were affected; CBC asked and did not get a number by its deadline. CBC also noted posts on regional Reddit forums from members who said they hit an error when trying to change their passwords after receiving the notice.
In the breach, and not in it
Accessed: member names and, where members had supplied them, mailing addresses, phone numbers, email addresses and dates of birth.
Not accessed, based on what the company knows so far: More Rewards IDs, passwords, credit card data and purchase history. The company says the accounts themselves, and members’ points, remain secure and that a password reset is not required.
Why the follow-up messages are the real worry
A list of names, emails, phone numbers and birthdays is exactly what a scammer needs to make a fake “your points are expiring” text or a fake fraud-department call sound real. The Canadian Centre for Cyber Security makes that point about stolen personal information generally, and Richard Frank, who directs Simon Fraser University’s international cybercrime centre, told CBC that loyalty programs usually hold enough detail to build realistic scams. The company says it will never contact members asking for passwords, verification codes, banking or card details, Social Insurance Numbers or security-question answers, and it is urging members to verify any unexpected request through contact details they already trust.
What this means for your company
Many businesses guard payment data carefully and treat their marketing or loyalty list as low-risk. This incident shows why that list deserves real protection too: it is the raw material for phishing aimed at your customers under your name. Collect only the fields you actually use (does the program really need a birth date?), keep that database separated from the rest of the network and watched for unusual access, and have a plain-language customer notice and FAQ ready before you need one. Remind staff, too, that their personal accounts with breached retailers can become a route to convincing lures at work.
Need help protecting the customer data in your loyalty, marketing or online-store systems? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
