Liam Tremblay
October 18, 2026
16 min read
Pattison Food Group confirmed on Friday, October 16, that customer personal information stored in the More Rewards loyalty database was accessed in a cybersecurity breach, the company said in statements reported by CTV News, Global News, and Castanet. The incident touches customers who shop at four grocery banners under the Pattison umbrella: Save-On-Foods, Buy-Low Foods, PriceSmart Foods, and Nesters. For a loyalty program that spans British Columbia, Alberta, and beyond, the breach lands at an awkward moment, just as Canadian regulators and banks are trying to build faster data-sharing defenses against exactly this kind of incident.
More Rewards said the names, and in some cases the addresses, phone numbers, email addresses, and dates of birth, of program members were accessed by an unauthorized party. The company has not disclosed how many customers were affected, a gap that privacy lawyers and security researchers say leaves millions of loyalty members in B.C. and Alberta unsure whether their own records were part of the exposure. This article breaks down what happened, what Pattison Food Group has and hasn’t confirmed, how the incident compares with other recent Canadian retail breaches, and what More Rewards members should do next.
Don’t miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What happened: timeline of the More Rewards data breach
According to Global News, More Rewards said its team discovered unauthorized activity on one of its servers on October 13. The company said it took immediate action that same day, shutting down the affected server and launching an investigation with the help of a third-party cybersecurity expert. Three days later, on Friday, October 16, Pattison Food Group confirmed that customer personal information in the More Rewards database had, in fact, been accessed. News coverage of the confirmation spread quickly on October 17 and October 18, picked up by regional outlets across the company’s B.C. and Alberta footprint.
That three-day window between discovery and confirmation is fairly typical for a retail-sector breach of this size. Security teams generally need time to determine the scope of unauthorized server access before a company is willing to put out a public statement, since getting the facts wrong in an early release can create legal exposure and confuse the customers a company is trying to warn. Still, for More Rewards members, the gap means the exposure had already existed for several days before anyone outside the company’s security team knew about it.
Pattison Food Group has stated plainly that it is notifying the appropriate authorities and privacy regulators, a step required under Canadian privacy law when a breach poses a real risk of significant harm to affected individuals. The company has set up a dedicated customer service line, 1-833-690-1146, for members with questions about their accounts.
What data was accessed, and what wasn’t
The categories of information More Rewards says were accessed are relatively narrow but still sensitive: customer names, and, where members had provided them, mailing addresses, phone numbers, email addresses, and dates of birth. That combination of identity fields is exactly the kind of data criminals use to build convincing phishing emails, impersonate a brand in text messages, or attempt account takeovers on other services where a customer reused personal details.
Pattison Food Group has been direct about what it says was not touched. In a statement to Global News, the company said: “Based on the information available to us, no other personal information (e.g., passwords, credit card data, or transaction history) was accessed, and the More Rewards accounts themselves remain secure.” Members should not need to reset passwords purely because of this incident, though specialists generally still recommend updating a password after any breach notification out of caution.
It’s worth being precise here: the company’s language is “based on the information available to us,” which is standard hedging language in early breach disclosures. Forensic investigations often continue for weeks after a public statement, and it’s not unusual for the list of affected data categories to expand once a full server image has been reviewed. More Rewards members should treat the current disclosure as the starting point, not necessarily the final word on what was exposed.
Pattison Food Group’s statement, in full context
Pattison Food Group, the parent company behind More Rewards and its affiliated grocery banners, gave Global News a short written statement confirming the breach: “We confirmed Friday that customers’ personal information on the More Rewards database was accessed.” That single sentence is the company’s clearest on-record acknowledgment that the October 13 server incident resulted in an actual exposure of customer data, rather than simply unauthorized access attempts that were blocked. CTV News carried the same confirmation in its Vancouver coverage of the incident.
More Rewards itself, in the customer notification quoted by Castanet, described the discovery and containment process: “Our team discovered unauthorized activity occurring on one of our servers on Oct. 13 and took immediate action that day to shut down the server and launch an investigation with a third-party cybersecurity expert.” The same notification addressed the regulatory side of the response: “The incident was quickly contained, and we are in the process of notifying the appropriate authorities and privacy regulators.” The notification closed with an apology of sorts: “We take our responsibility to protect personal information seriously and regret any inconvenience this may cause.”
None of the company’s public statements include a customer count, a technical root cause, or the name of the third-party cybersecurity firm leading the investigation. That is consistent with early-stage breach disclosures across the industry, where companies tend to release only what has been legally confirmed and hold back operational detail until an investigation wraps up or until regulators require a fuller report.
Who is affected: Save-On-Foods, Buy-Low Foods, PriceSmart Foods, and Nesters shoppers
More Rewards is the shared loyalty program across several Pattison-owned grocery banners in Western Canada. That means the breach potentially touches anyone who has signed up for a More Rewards card or app account at Save-On-Foods, Buy-Low Foods, PriceSmart Foods, or Nesters, regardless of which specific store they shop at most. Because these banners operate largely in British Columbia and Alberta, the practical impact of the breach is concentrated in those two provinces, even though the companies involved have a national corporate footprint through parent company Jim Pattison Group.
The lack of a disclosed customer count is the single biggest open question hanging over this story. Loyalty programs at this scale typically carry customer databases numbering in the hundreds of thousands to low millions, but More Rewards has not put a figure on the record, and no regulator filing with a specific number has surfaced publicly as of October 18. Members have no way to confirm from the company’s statements alone whether their individual record was part of the exposure; the practical guidance from privacy specialists is to assume you could be affected if you have ever registered a More Rewards account, and to act accordingly.
How this compares with other recent Canadian retail data breaches
The More Rewards breach fits a pattern that has become familiar across Canadian retail in 2026: attackers increasingly go after customer and loyalty databases rather than payment infrastructure. Loyalty programs are an attractive target precisely because they hold rich identity and contact data on a large, engaged customer base, information that’s valuable for phishing and account-takeover schemes even when no credit card numbers or passwords are exposed. Reports this year have also described a separate breach affecting Loblaw Companies customer contact information, underscoring that this is not an isolated incident at one retailer but a broader trend across Canada’s grocery sector. There is no indication the Loblaw incident and the More Rewards breach are technically connected; they appear to be separate events affecting separate companies.
What distinguishes the More Rewards case from a worst-case retail breach is the narrower scope of exposed data. The company says payment card numbers, passwords, and transaction history were not accessed, which, if that holds up under further forensic review, puts this closer to a contact-information exposure than a full-blown financial breach. That distinction matters for how seriously affected customers should treat follow-up emails or calls claiming to be from More Rewards: the company has already said it will never ask for passwords, verification codes, banking details, Social Insurance Numbers, or security-question answers, so any message requesting that information should be treated as fraudulent regardless of how official it looks.
Why loyalty programs keep getting breached
Grocery loyalty programs occupy an odd position in the retail security landscape. They are not typically subject to the same payment-card industry security standards that govern point-of-sale systems, yet they often sit on customer databases that are just as large and, in some ways, more useful to an attacker running a long-con phishing campaign. A stolen credit card number gets canceled within days. A stolen name, date of birth, and address can be recombined with data from other breaches for years, feeding identity theft schemes and highly targeted social-engineering attacks that are harder for banks and customers to catch.
The economics also favor attackers. Loyalty databases are frequently built up over a decade or more of customer sign-ups, migrated across legacy systems, and connected to marketing, analytics, and app infrastructure that expands the attack surface well beyond a single, tightly controlled payment gateway. Security researchers covering the retail sector note that this sprawl, rather than any single catastrophic flaw, is usually what gives attackers an opening. Whether that pattern applies to the More Rewards server compromise specifically is something only Pattison Food Group’s investigation, and any eventual regulator report, will be able to say for certain.
Market and business impact for Pattison Food Group
Pattison Food Group is a privately held subsidiary of the Jim Pattison Group, so there is no public stock price to move on breach news the way there might be for a publicly traded retailer. That insulates the company from the kind of immediate market reaction seen when a publicly listed firm discloses a cyber incident, but it does not insulate it from the real costs: forensic investigation fees, the third-party cybersecurity expert already engaged, likely credit-monitoring or identity-protection offers to affected customers, regulatory reporting obligations, and potential class-action exposure if the number of affected customers turns out to be large once disclosed.
There’s also a reputational dimension specific to loyalty programs. More Rewards exists to drive repeat visits to Save-On-Foods, Buy-Low Foods, PriceSmart Foods, and Nesters by rewarding customers for sharing their shopping data and contact details. A breach undercuts the basic trust proposition of that exchange: customers hand over personal information expecting it will be protected in return for discounts and points. If members start opting out of the loyalty program, or simply stop providing full personal details at sign-up, the breach could have a quieter but longer-lasting effect on the value of the More Rewards database itself, separate from any direct financial penalty.
What More Rewards members should do right now
Pattison Food Group’s own guidance centers on phishing awareness: the company has told customers to watch for suspicious emails, texts, or calls claiming to be from More Rewards, and has been explicit that it will never request passwords, one-time verification codes, banking or payment-card details, Social Insurance Numbers, or answers to security questions. Anyone who receives a message asking for that information, even one that appears to reference a real More Rewards account, should assume it is a scam exploiting the breach and should contact the company directly using the published customer service line rather than replying to the message.
Beyond following the company’s own advice, there are a few practical steps worth taking. First, be skeptical of any unsolicited contact that references your name, address, or date of birth as a way of appearing legitimate; attackers who obtained this data from the breach can use it to make phishing attempts far more convincing than a generic scam message. Second, if you reused your More Rewards email address and a simple password combination on other accounts, this is a reasonable moment to update those passwords and turn on two-factor authentication where it’s available, even though the company says passwords were not accessed in this particular incident. Third, keep an eye on mail and email for any official notification you may receive directly from More Rewards, since the company has said it is in the process of notifying affected customers and the relevant privacy regulators.
Readers who want to check more broadly whether their email address has turned up in other known breaches can use a dedicated breach-lookup tool; our guide to setting up Have I Been Pwned alerts walks through how to configure ongoing monitoring instead of a one-time search. For anyone who wants to tighten up their password hygiene in response to a breach like this one, our walkthrough on setting up Bitwarden covers the basics of moving to unique, generated passwords across accounts.
The regulatory backdrop: Canada’s breach notification rules
Under Canada’s federal private-sector privacy law, organizations that experience a breach of security safeguards involving personal information must notify the Office of the Privacy Commissioner of Canada, and affected individuals, when the breach creates a real risk of significant harm. Factors regulators weigh include the sensitivity of the information involved and the probability it will be misused. Names, addresses, phone numbers, and dates of birth sit in a middle tier of sensitivity: not as immediately damaging as a leaked password or credit card number, but still useful enough for identity-theft-adjacent fraud that most privacy lawyers would expect a breach of this profile to trigger mandatory notification.
Pattison Food Group’s statement that it is notifying “appropriate authorities and privacy regulators” suggests the company has made its own determination that this threshold is met, even before any regulator has issued a public statement on the incident. British Columbia also maintains its own provincial private-sector privacy law, the Personal Information Protection Act, which applies to organizations operating in the province and carries its own breach-notification expectations that would run in parallel with the federal process for a B.C.-based retailer like Save-On-Foods.
Industry context: Canada’s push for faster fraud-data sharing
The timing of the More Rewards breach is notable against the backdrop of broader efforts in Canada to speed up how financial institutions and telecoms share fraud-related data. Our recent coverage of the CSAFE anti-fraud data exchange launch detailed how nine banks and carriers are now pooling fraud signals to catch account-takeover and scam attempts faster. A breach like this one, which exposes exactly the kind of contact information used to seed phishing and social-engineering attacks, is a reminder of why that kind of cross-industry data sharing has become a priority: stolen names, emails, and phone numbers from a grocery loyalty program can end up feeding fraud attempts against entirely unrelated banks and telecom accounts weeks or months later.
It’s also worth situating this alongside other recent Canadian cybercrime enforcement news. Our report on the FBI’s arrest of a Canadian national connected to the ShinyHunters hacking group showed that Canadian individuals are turning up on both sides of the country’s cybercrime story this fall, as alleged participants in major breaches and, as in the More Rewards case, as the customers whose data ends up exposed. Whether or not the two cases are connected (nothing in the public record suggests they are), the pairing illustrates how active the breach-and-fraud ecosystem touching Canadian consumers has become heading into the end of 2026.
What we still don’t know
Several important questions remain open as of October 18. More Rewards has not disclosed how many customer records were accessed, leaving members unable to gauge the scale of the incident relative to other Canadian breaches this year. The company also hasn’t named the third-party cybersecurity firm leading its investigation, nor has it described the technical root cause, such as whether the server compromise stemmed from a phishing attack on an employee, an unpatched vulnerability, stolen credentials, or a third-party vendor issue. There is also no public confirmation yet from the Office of the Privacy Commissioner of Canada or British Columbia’s Office of the Information and Privacy Commissioner on whether, or how, they are reviewing the incident.
Claims circulating that passwords were part of the exposure remain unconfirmed and are directly contradicted by Pattison Food Group’s own statement that passwords were not accessed and that accounts remain secure. Readers should treat any secondary report claiming otherwise with skepticism until the company or a regulator says so directly.
Predictions: where the More Rewards breach story goes next
- Expect Pattison Food Group to eventually disclose an approximate customer count, likely once direct notifications to affected members are complete or once a regulator requires a fuller report; companies in this position typically hold the figure back only through the first one to two weeks of public disclosure.
- Watch for a free credit-monitoring or identity-protection offer to affected customers, a now-standard response among Canadian and North American retailers following a breach involving names, addresses, and dates of birth, even when financial data wasn’t touched.
- Phishing campaigns impersonating More Rewards, Save-On-Foods, Buy-Low Foods, PriceSmart Foods, or Nesters are likely to spike in the coming weeks as opportunistic scammers try to exploit public awareness of the breach; expect More Rewards to repeat its phishing warning in follow-up communications.
- The Office of the Privacy Commissioner of Canada and/or British Columbia’s provincial privacy regulator will likely open a review given the scale of the retail footprint involved, though a public ruling or penalty, if any, would typically take months to materialize.
- This incident will likely get cited alongside the 2026 Loblaw customer-data breach in ongoing industry and media discussion about whether Canadian grocery retailers are investing enough in securing the loyalty databases that now sit behind nearly every major chain’s rewards program.
Competitive comparison: how major Canadian grocery loyalty programs stack up on breach response
While detailed, independently audited security postures for competing Canadian grocery loyalty programs aren’t public, the public response pattern to breach disclosures gives a rough sense of industry norms. The table below summarizes what’s publicly confirmed about the More Rewards breach next to the general shape of how Canadian retailers have handled comparable incidents in 2026, based on company statements reported by named outlets.
Historical context: a growing list of Canadian retail breaches
Canadian retailers have faced a steady drumbeat of customer-data incidents through 2025 and 2026, as loyalty and e-commerce databases have become as attractive a target as payment systems once were. The pattern across these incidents tends to follow a similar arc: discovery of unauthorized server or network activity, containment within hours or days, engagement of outside forensic help, and a public statement that narrows the exposed data categories as far as the company can confidently state at the time. The 2026 breach affecting Loblaw Companies customer contact information followed a broadly similar shape, as have several mid-sized retail incidents reported this year across the country.
What makes the More Rewards case worth tracking closely is less the breach mechanics, which so far look like a fairly standard contact-database exposure, and more the fact that it touches four separate, well-known grocery banners through a single shared loyalty program. That structure, common across Canadian grocery chains that consolidate rewards under one umbrella brand, means a single server compromise can ripple across a much larger customer base than a breach confined to one store brand’s systems.
Deep analysis: what the limited disclosure tells us
Reading between the lines of Pattison Food Group’s statements, a few things stand out. The company moved quickly on containment, shutting down the affected server the same day unauthorized activity was spotted, which suggests either strong internal monitoring or an obvious indicator of compromise. The three-day gap before public confirmation is consistent with a company running a scoping exercise to determine which data categories were touched, rather than a company stalling for reputational reasons.
At the same time, the absence of a customer count nearly a week after discovery is a meaningful gap. Companies that disclose a count early tend to do so because the forensic scoping work is straightforward, such as a single export file with a known row count. The absence of a number here could reflect an ongoing investigation, or a more complex database structure that makes an exact count harder to pin down quickly. Readers should be wary of any third-party estimate of the customer count that isn’t attributed directly to the company or a regulator.
Frequently asked questions
Was my More Rewards account hacked?
More Rewards has not disclosed a specific customer count, so there is no public way to confirm whether any individual account was part of the exposure. The company says it is notifying affected customers directly, so members who registered a More Rewards account should watch for an official communication and, in the meantime, be alert for phishing attempts that reference their personal details.
Were my More Rewards passwords stolen?
Pattison Food Group has stated that, based on the information available to it, passwords were not accessed and that More Rewards accounts remain secure. Reports claiming passwords were part of the exposure are unconfirmed and contradict the company’s own statement.
Which stores are affected by the More Rewards breach?
The More Rewards loyalty program covers Save-On-Foods, Buy-Low Foods, PriceSmart Foods, and Nesters, all operated under Pattison Food Group.
Was my credit card information exposed in the More Rewards breach?
No. The company says credit card data and transaction history were not accessed, based on the information available to it at the time of its statement.
What should I do if I get a suspicious email or text about More Rewards?
Do not click links or reply with personal information. More Rewards has said it will never ask customers for passwords, verification codes, banking or payment-card information, Social Insurance Numbers, or security-question answers. If you’re unsure whether a message is legitimate, contact More Rewards directly through its customer service line at 1-833-690-1146 rather than responding to the message itself. Our guide to spotting phishing scams covers the common red flags to check for.
How many customers were affected by the More Rewards data breach?
Pattison Food Group has not disclosed a specific number of affected customers as of October 18, 2026.
Has More Rewards notified Canadian privacy regulators?
The company says it is in the process of notifying the appropriate authorities and privacy regulators, consistent with obligations under Canadian federal and provincial privacy law for breaches that pose a real risk of significant harm.
Who do I contact with questions about the More Rewards breach?
More Rewards has set up a customer service line at 1-833-690-1146 for members with questions about the incident and their accounts.
