A prominent Canadian grocery chain has informed members of its loyalty program that their personal details were compromised in a cyber attack. Save-On-Foods, a supermarket chain based in Western Canada, detected unauthorized activity on one of its servers on October 13, which was swiftly contained. Following this discovery, the company launched an investigation with a cybersecurity specialist and subsequently sent an email to its More Rewards customers.
The email addressed the incident involving the compromise of personal information, including names, addresses, phone numbers, email addresses, and dates of birth of the affected customers. Although the exact number of customers impacted by the breach was not disclosed by Save-On-Foods, the Pattison Food Group, the parent company of the grocery chain, states on its website that the More Rewards program boasts over 3.5 million members.
Save-On-Foods mandates online shoppers to enroll in the More Rewards program, which grants members exclusive in-store discounts. The email assured customers that, based on current information, no other sensitive data like credit card details or passwords was accessed.
Despite this, the Canadian Centre for Cyber Security highlighted concerns about the potential misuse of personal information obtained by cybercriminals. This data could be exploited in phishing attacks, where scammers impersonate trusted entities to deceive individuals into divulging confidential information or making financial transactions.
Richard Frank, the director of Simon Fraser University’s international cybercrime center, emphasized that cybercriminals often exploit corporate networks through employees inadvertently engaging with malicious content. Loyalty programs like More Rewards provide ample details for scammers to craft convincing scams, utilizing personal information to launch various fraudulent activities, including identity theft and financial fraud.
Moreover, the community response to the security breach has been marked by frustration, with individuals expressing concerns about the vulnerability of personal data collected through loyalty programs. Reddit users in British Columbia and Alberta communities voiced apprehension over the potential corporate sale of personal information and the increased susceptibility to cybercrime due to such data breaches.
Members of the More Rewards program were advised to remain vigilant against suspicious communications and refrain from sharing sensitive information. Save-On-Foods affirmed that they would not request passwords, banking details, or other confidential data via unsolicited messages. The supermarket chain also stated that it had informed relevant authorities and privacy regulators about the breach, although confirmation from the Office of the Information and Privacy Commissioner for British Columbia was pending at the time of publication.
