More Rewards data incident: what BC shoppers and businesses should do

Pattison Food Group, which operates Save-On-Foods and other Western Canadian grocery banners, told More Rewards members on 16 October 2026 that unauthorized activity was found on a server used for the loyalty program. The company said it discovered the activity on 13 October, shut that server down the same day, and brought in a third-party cybersecurity expert. It said the incident was contained and that it was notifying authorities and privacy regulators.

This summary is for households and businesses that use More Rewards. It is not a Save-On-Foods or Pattison Food Group statement, and it does not copy their email. The facts below follow the customer notice as published by Fraser Valley News Network on 16 October 2026.

What was accessed

The 16 October notice said the More Rewards database fields accessed were the member’s name and, where they had been provided, address, phone number, email addresses and date of birth.

The same notice said that, based on information available to the company at that time, passwords, credit-card data and transaction history were not accessed, and that the More Rewards account remained secure. Fraser Valley News Network’s own paraphrase mentioned passwords; that does not match the quoted notice, so we do not treat passwords as confirmed stolen.

Why name, address and date of birth still matter

Even without card numbers, a name, home address, phone number, email and date of birth are enough for convincing phishing and identity fraud. The Canadian Centre for Cyber Security warns that personal details from a breach can make phishing emails, texts and calls look legitimate, and that threat actors use that information to trick people into handing over passwords, codes or money.

Expect follow-on messages that look like More Rewards, Save-On-Foods or a bank. The company notice itself said it will not ask for passwords, verification codes, banking or payment-card details, a Social Insurance Number, or security-question answers, and asked people to check unexpected requests through contact details they already know.

What households should do

• Treat unexpected emails, texts or calls about More Rewards points, “account recovery” or a refund as suspicious. Do not click links or open attachments in those messages.
• Sign in only through a site or app you already use, not through a link in a new message.
• Watch bank and credit-card statements. The company said card data was not accessed; phishing after a notice can still steal it.
• If you reuse the same password on other sites, change those passwords. The company said More Rewards passwords were not accessed; reuse is still a risk on other accounts.
• If you suspect identity fraud, follow the Canadian Centre for Cyber Security steps and report to the Canadian Anti-Fraud Centre and local police.

What this means for a local business

Loyalty and customer lists are a target even when payment cards sit in a different system. A name, email, phone number and date of birth are enough for spear-phishing aimed at your staff or your customers. If you store a similar list for a punch-card, newsletter or booking tool, ask where it lives, who can reach that server, and how you would notice unauthorized activity.

This incident is not a reason to invent extra duties for Save-On-Foods. It is a reminder to keep customer databases patched, backed up, and off the same box as everything else, and to tell customers how you will contact them after a notice so a fake email is easier to spot.

How Techloom can help

Techloom can help Lower Mainland businesses review where customer data is stored, how staff sign in, and what to do if a phishing wave follows a public notice, as a security assessment or through managed IT. We did not investigate this incident and we do not replace Pattison Food Group customer service or privacy regulators.

Sources

More Rewards Program (Specifically Pattison Foods/Save On Foods) Cyber Hack – Customer Info Compromised, Fraser Valley News Network, 16 October 2026 (quotes the 16 October More Rewards customer notice). Don’t take the bait: Recognize and avoid phishing attacks (ITSAP.00.101), Canadian Centre for Cyber Security. Protecting yourself from identity theft online (ITSAP.00.033), Canadian Centre for Cyber Security.