A popular supermarket chain in Canada has informed members of its loyalty program that their personal details were compromised in a cyberattack. Save-On-Foods, a grocery retailer in Western Canada, detected unauthorized activity on one of its servers on October 13. The incident was contained promptly, and an investigation with a cybersecurity specialist was initiated.
Customers enrolled in the More Rewards program received an email notifying them about the security breach. The email disclosed that names, addresses, phone numbers, email addresses, and dates of birth of affected customers were accessed.
Although the exact number of impacted customers was not provided by Save-On-Foods, the parent company, Pattison Food Group, stated on its website that the More Rewards program boasts over 3.5 million members. Participation in the program is mandatory for online shoppers and offers exclusive discounts.
The email assured customers that, based on current information, sensitive details like credit card data or passwords were not compromised. However, cybersecurity experts warn that cybercriminals can exploit personal information from breaches to conduct phishing attacks, posing as legitimate entities to deceive individuals into revealing confidential data or making financial transactions.
Richard Frank, the director of Simon Fraser University’s international cybercrime center, explained that cyber attackers often infiltrate networks through employees unwittingly engaging with malicious content. Loyalty programs provide ample data for scammers to craft convincing scams.
Personal information stolen by cybercriminals can be used to impersonate organizations, solicit more data, or distribute malware. This information can facilitate identity theft, financial fraud, or unauthorized purchases through online stores and cryptocurrency markets.
In response to the incident, members of online communities like Reddit expressed concerns over privacy and data security. Some users reported issues when attempting to change their passwords following the breach notification.
Save-On-Foods advised More Rewards members to remain cautious of suspicious communications and assured that they would not request sensitive information like passwords, banking details, or social insurance numbers. The supermarket chain confirmed that relevant authorities and privacy regulators were notified of the breach.
Efforts to reach the Office of the Information and Privacy Commissioner for British Columbia for comment on the breach incident were unsuccessful at the time of publication.