A cybersecurity incident at Canadian supermarket chain Save-On-Foods exposed personal details linked to its More Rewards loyalty program. The compromised information included members’ names and any addresses, phone numbers, email addresses, and birth dates they had provided.
Here’s what to know
According to CBC News, Save-On-Foods said it found unauthorized activity on one of its servers on Oct. 13, had the incident “quickly contained,” and then investigated with help from a cybersecurity expert.
In notices sent to customers, Save-On-Foods said the information involved included names, addresses, phone numbers, email addresses, and birth dates members had supplied. The company also said that “based on the information available,” more sensitive information, including passwords or credit card details, was not accessed.
Because Save-On-Foods requires customers to join More Rewards for online shopping, the same program used for in-store discounts also collects the personal information tied to those conveniences. That means personal information is part of the cost of convenience and savings.
Simon Fraser University’s Richard Frank, director of its international cybercrime center, said scammers can still get significant value from loyalty-program records because “loyalty programs usually provide enough details to make realistic scams,” per CBC News.
More background
CBC News asked Save-On-Foods for the number of affected customers, but it had not provided a figure by the time of publication.
According to The Pattison Food Group, More Rewards has over 3.5 million members. Even without passwords or payment card data, a breach affecting a program of that size can still pose serious risks if criminals use personal details to craft convincing phishing attempts.
Frank emphasized that “most of these break-ins are opportunistic” and that attackers often get into company networks after employees click malicious links or download malware. Once inside, he said, criminals can “map the network” and identify what they can steal to monetize.
What can be done?
Save-On-Foods told More Rewards customers to stay alert for suspicious calls or messages after the breach.
The company also said it will not send messages requesting passwords, banking details, payment information, social insurance numbers, or answers to security questions.
Save-On-Foods said in an email that it notified the appropriate authorities and privacy regulators. CBC News also contacted the Office of the Information and Privacy Commissioner for B.C. to confirm whether it had been notified, but received no response before publication.
Get TCD’s free newsletters for easy tips, smart advice, and a chance to earn $5,000 toward home upgrades. To see more stories like this one, change your Google preferences here.
