A leading Canadian grocery chain, Save-On-Foods, has informed members of its loyalty program that their personal details were compromised in a cybersecurity incident. The breach, discovered on October 13, involved unauthorized access to one of the company’s servers, which was promptly contained. Following this, Save-On-Foods collaborated with cybersecurity experts to investigate the breach.

Customers enrolled in the More Rewards program received an email notification on Friday regarding the incident. The email disclosed that accessed information included names, addresses, phone numbers, email addresses, and dates of birth, if provided by the customers. Although the exact number of affected individuals was not disclosed by Save-On-Foods, the Pattison Food Group, the chain’s parent company, states that the More Rewards program boasts over 3.5 million members.

Save-On-Foods mandates online shoppers to be part of the More Rewards program, which not only provides exclusive in-store discounts but also requires personal information for enrollment. The email assured customers that, based on the available information, no sensitive data such as credit card details or passwords were compromised.

Despite this, cybersecurity experts warn that cybercriminals could leverage the stolen personal information for phishing attacks, where they impersonate legitimate organizations to deceive individuals into sharing sensitive information or making financial transactions. Richard Frank, the director of Simon Fraser University’s international cybercrime center, emphasized that loyalty program details often provide enough information for scammers to conduct realistic fraudulent activities.

In response to the breach, Save-On-Foods urged More Rewards members to remain vigilant against suspicious communications, emphasizing that the company would never request passwords, banking details, payment information, social insurance numbers, or security question answers through unsolicited messages. The company also stated that it had notified relevant authorities and privacy regulators about the incident, although it did not receive a response from the Office of the Information and Privacy Commissioner for B.C. when contacted by CBC News.