More Rewards breach: grocery loyalty members' details accessed
More Rewards, the loyalty program used at Save-On-Foods and other Pattison Food Group stores in Western Canada, confirmed on October 16, 2026 that customers' names and, where provided, addresses, phone numbers, email addresses and dates of birth were accessed.
What happened
More Rewards discovered unauthorised activity on one of its servers on October 13, 2026 and shut the server down the same day, launching an investigation with a third-party cybersecurity expert. On October 16, 2026 it confirmed that personal information on the More Rewards database had been accessed during the incident, and it emailed affected customers the same day. The company said the incident was quickly contained and that it is notifying the appropriate authorities and privacy regulators.
Who is affected
Members of More Rewards, the loyalty program used at Save-On-Foods, Buy-Low Foods and Quality Foods on Vancouver Island and at Save-On-Foods locations elsewhere in Western Canada. More Rewards did not tell CTV News how many customers were affected. The information accessed was each member’s name and, if provided, address, phone number, email addresses and date of birth. The company said that, based on the information available to it, no other personal information — such as passwords, credit card data or transaction history — was accessed, and that More Rewards accounts remain secure.
How serious
The concrete risk is targeted phishing: names, contact details and dates of birth are enough for scammers to send messages or make calls that claim to be from More Rewards or Save-On-Foods and get the personal details right, then ask for the things the real company says it will never request — passwords, verification codes, banking or payment card information, Social Insurance Numbers or security question answers. Because the company says passwords and card data were not accessed, direct account takeover and card fraud are not the immediate risks.
What to do now
More Rewards told customers it will never contact them for sensitive information such as a password, verification codes, banking or payment card information, a Social Insurance Number or security question answers. If a message or call claiming to be from More Rewards asks for any of those, or pushes you to click a link or open an attachment you were not expecting, verify it using contact information you already know is legitimate — not the contact details in the message itself.
Sources: Fraser Valley News Network (customer notification, Oct 16) · CTV News (republished by Bitcomme)