A prominent Canadian grocery chain has informed participants in its loyalty program that their personal details were compromised in a cybersecurity breach. Save-On-Foods, a supermarket chain in Western Canada, identified unauthorized activity on one of its servers on October 13, promptly containing the breach and initiating an investigation with a cybersecurity specialist. A notification email was subsequently sent to More Rewards customers regarding the incident.
The email informed recipients that their names, and potentially their addresses, phone numbers, email addresses, and dates of birth were accessed. Save-On-Foods was questioned by CBC News about the number of affected customers but did not provide a specific figure by the deadline. The Pattison Food Group, the owner of the grocery chain, disclosed on its website that the More Rewards program boasts over 3.5 million members.
To access online shopping services, Save-On-Foods mandates membership in the More Rewards program, which also offers exclusive in-store discounts to participants. The email assured customers that, based on available information, sensitive data such as credit card details or passwords were not compromised.
While personal information can facilitate phishing attempts, cybercriminals may exploit it to deceive individuals into disclosing sensitive data or sending money under the guise of reputable entities. According to Richard Frank, the director of Simon Fraser University’s international cybercrime center, cybercriminals often infiltrate corporate networks through malicious links or malware inadvertently accessed by employees.
Frank emphasized that loyalty programs provide cybercriminals with enough information to orchestrate convincing scams. Criminals may use personal details to impersonate companies in fraudulent emails containing malicious links, potentially resulting in identity theft, financial information theft, or credit card fraud. This stolen information could be used to make unauthorized purchases online or in crypto markets.
A number of Reddit users from British Columbia and Alberta communities expressed frustration with loyalty programs requiring personal information, arguing that such data could be exploited by corporations and make individuals vulnerable to cybercrime. Some users who tried to reset their passwords after receiving the breach notification encountered recurring errors, as reported on Reddit.
More Rewards members are advised to remain cautious of suspicious communications and Save-On-Foods reassured that they would not solicit passwords, banking details, or other sensitive information via communication channels. The supermarket chain affirmed that it had informed relevant authorities and privacy regulators about the incident. CBC News attempted to contact the Office of the Information and Privacy Commissioner for British Columbia for confirmation but did not receive a response before publication.