1 (888) 897-3611 Book a call

Breach report · Retail

Save-On-Foods More Rewards breach: what members should do

Pattison Food Group says More Rewards member data was accessed in an Oct. 13, 2026 breach. Passwords and cards weren't, it says. Watch for phishing.

By happier IT 5 min read

Pattison Food Group says someone accessed personal information in its More Rewards loyalty database, used at Save-On-Foods and other Western Canadian grocery stores. It found the activity on October 13, 2026 and emailed affected members on October 16. If you’re a member, expect convincing scam messages and don’t share personal details with anyone who contacts you.

What happened

The company says it found unauthorized activity on one of its servers on Tuesday, October 13, 2026, shut that server down the same day, and brought in a third-party cybersecurity expert to investigate. “The incident was quickly contained,” it said, as reported by Castanet and the Vancouver Sun.

Members were notified by email on Friday, October 16. According to that email, the information accessed was names and, where members had provided them, addresses, phone numbers, email addresses and dates of birth. A spokesperson told the Vancouver Sun that, according to the information available, passwords, credit card data and transaction history were not accessed. Global News reported the company saying More Rewards accounts themselves remain secure.

The company told CBC News it has notified “the appropriate authorities and privacy regulators”, without naming them.

What is not yet known: how many members are affected, how the attacker got in, and whether the data has been published or offered for sale. The company did not give CBC or the Vancouver Sun a number by their deadlines. The Vancouver Sun reported that “thousands” of customers were notified.

Who is affected

More Rewards members whose records were in the accessed database. Global News named Save-On-Foods, Buy-Low Foods, PriceSmart Foods and Nesters among the stores where the program is used. CBC described Save-On-Foods as a Western Canadian chain, and noted members discussing the notice in both BC and Alberta online communities.

If you didn’t receive an email from More Rewards, the company hasn’t said you’re affected. Being careful costs nothing either way.

What to do now

If you’re a More Rewards member:

  1. Expect targeted scams. CBC reported the Canadian Centre for Cyber Security’s point that personal details make phishing (fake messages that try to get you to click, pay or share information) more convincing. A Simon Fraser University cybercrime researcher told CBC that loyalty data usually gives criminals enough to make realistic scams.
  2. Know what the company won’t ask for. It says it won’t contact you for verification codes, passwords, banking or payment card details, Social Insurance Numbers, or security question answers.
  3. Don’t use links or numbers in unexpected messages. Open the More Rewards app or website yourself, or call a number you already know is real, as the company advises.
  4. Tighten the account anyway. Change your More Rewards password as a precaution, and change it anywhere else you reused it.
  5. Watch your other accounts. Your date of birth and address are often used to confirm identity. Keep an eye on bank and card statements, and turn on MFA (multi-factor authentication, a second step such as a code from an app) wherever it’s offered.

If you run an organization:

  1. Brief your team. Staff who shop at these stores may receive realistic grocery or rewards-themed scams at work as well as at home. A short reminder now helps.
  2. Look at your own customer data. Loyalty and marketing databases tend to grow quietly. Collect only what you use, and know where it lives and who can reach it.
  3. Check your incident plan. Contain, investigate with expert help, then notify people. Make sure your own plan covers each step and names who does what.

What this means for organizations in BC and Alberta

Which privacy law applies depends on where and how an organization operates. The reporting rules differ:

  • British Columbia: the private-sector Personal Information Protection Act (PIPA) does not currently require organizations to report breaches. The Office of the Information and Privacy Commissioner for BC (OIPC BC) “strongly recommend[s]” reporting them as a best practice, and has called on government to make it mandatory. Public bodies under BC’s Freedom of Information and Protection of Privacy Act (FIPPA) must report breaches that could reasonably be expected to cause significant harm.
  • Alberta: under section 34.1 of Alberta’s PIPA, an organization must notify the Information and Privacy Commissioner without unreasonable delay when a reasonable person would consider there is a real risk of significant harm. The Commissioner can require the organization to notify affected individuals.
  • Federally: organizations covered by the Personal Information Protection and Electronic Documents Act (PIPEDA) must report breaches that create a real risk of significant harm to the Office of the Privacy Commissioner of Canada, notify affected people as soon as feasible, and keep a record of every breach for two years.

For organizations in British Columbia and Alberta, the safest habit is the same everywhere: document what happened, assess the risk of harm, and report when in doubt.

How happier IT helps

After an incident like this, the main risk for most people is a believable scam message, so our security awareness training helps staff recognize and report scams calmly. If something does get through, our incident response team can help you contain it and work through what needs reporting. A free IT assessment is an easy place to start.

Sources

More from the feed

Other incidents we've written up.

Want to know what this would look like for you?

A 30-minute call. No slides, no audit fee, no obligation. We ask what is breaking and tell you honestly whether we are the right fit.

Book a 30-minute call Get a free IT assessment

Or call 1 (888) 897-3611