A leading supermarket chain in Canada has informed members of its loyalty program that their personal data was compromised in a recent cybersecurity breach. Save-On-Foods, a grocery chain based in Western Canada, identified unauthorized activity on one of its servers on October 13. The incident was promptly contained, leading to an investigation with cybersecurity experts. Affected customers were notified via email, disclosing that their names, addresses, phone numbers, email addresses, and dates of birth were accessed.
Although the exact number of impacted customers was not provided by Save-On-Foods, the parent company, Pattison Food Group, states that the More Rewards program boasts over 3.5 million members. Save-On-Foods mandates online shoppers to enroll in the More Rewards program, which offers exclusive discounts to members.
The email sent to customers assured them that, based on current information, no sensitive data like credit card information or passwords was compromised. However, cybersecurity experts warn that personal information can be exploited by cybercriminals for phishing attacks, where they impersonate trusted entities to deceive individuals into divulging confidential information or sending money.
Richard Frank, director of Simon Fraser University’s international cybercrime center, emphasized that cybercriminals often exploit personal data from loyalty programs to orchestrate convincing scams. This stolen information can be leveraged to perpetrate fraudulent activities, including making unauthorized purchases online or in cryptomarkets.
In response to the breach, numerous individuals on Reddit forums in British Columbia and Alberta expressed concerns about the security of loyalty programs requiring personal information. Some users reported encountering errors when attempting to change their passwords following the breach notification. Save-On-Foods has advised More Rewards members to remain vigilant against suspicious communications and assured that they will not request passwords, banking details, or sensitive information through unsolicited messages.
Save-On-Foods has informed relevant authorities and privacy regulators about the breach. However, the Information and Privacy Commissioner for British Columbia had not responded to queries from CBC News at the time of publication regarding the incident.