Save-On-Foods, a prominent Canadian grocery chain, has informed members of its loyalty program that their personal data was compromised in a cyber attack. The breach was detected on October 13, involving unauthorized access to a server, which was promptly contained. Following this, an email was sent to More Rewards customers notifying them of the incident.
Affected customers were informed that their names, addresses, phone numbers, email addresses, and dates of birth were accessed during the breach. It remains unclear how many customers were impacted by the breach, given that Save-On-Foods did not disclose this information within the deadline provided.
The Pattison Food Group, the owner of Save-On-Foods, states that the More Rewards program boasts over 3.5 million members. The program, which offers exclusive in-store discounts, is a requirement for online shoppers at Save-On-Foods.
Despite the breach, the company assured customers that no other sensitive information like credit card details or passwords was compromised. However, there are concerns that cybercriminals could utilize the accessed personal data in phishing attacks, posing as trusted entities to deceive individuals into disclosing confidential information or making financial transactions.
According to cybersecurity experts, cybercriminals often exploit personal information to craft convincing scams, impersonate companies, and conduct fraudulent activities like making unauthorized purchases online or in cryptomarkets. The compromised information can be leveraged for various nefarious purposes, potentially leading to identity theft or financial losses for affected individuals.
In response to the breach, some Reddit users expressed concerns about the privacy implications of loyalty programs that collect personal data. Additionally, customers who attempted to change their passwords after receiving notifications reportedly encountered technical issues on the More Rewards membership website.
Save-On-Foods has advised More Rewards members to remain vigilant against suspicious communications and assured that they would not request sensitive details like passwords, banking information, or social insurance numbers through unsolicited messages. The company has also stated that it has informed relevant authorities and privacy regulators about the breach, although confirmation from the Office of the Information and Privacy Commissioner for B.C. is pending.