Save-On-Foods, the Western Canadian supermarket chain owned by the Pattison Food Group, has told members of its More Rewards loyalty program that an unauthorized party accessed their personal information. The company says it found unauthorized activity on one of its servers on Tuesday, October 13, 2026, and shut the server down that day. On Friday, October 16, it emailed affected customers to confirm that names were taken from the More Rewards database, along with addresses, phone numbers, email addresses and dates of birth where members had provided them. The company has not said how many people are affected. CBC News asked for a figure and got none by deadline. The Province describes the affected group only as "thousands" of customers. No threat actor has claimed the attack, and the company has not said how the attackers got in. None of the sources for this brief is a primary document such as a regulator filing or a statement published by the company. Everything the company has said comes from its customer email, as quoted by CBC, the Prince George Citizen and The Province.
What Happened
The outlets agree on the timeline:
- October 13 (Tuesday): Staff found unauthorized activity on a server holding More Rewards data. According to the customer email quoted by the Prince George Citizen and The Province, the company "took immediate action that day to shut down the server and launch an investigation with a third-party cybersecurity expert."
- October 16 (Friday): Notification emails went out to More Rewards members. The Citizen says they reached customers across British Columbia. The email says the incident "was quickly contained" and that the company is "in the process of notifying the appropriate authorities and privacy regulators."
- October 17 to 18: Regional and national outlets picked up the story. Tech-Insider names CTV News, Global News and Castanet among them. When The Province asked for more information on Saturday, the company sent back the text of the customer email.
The company took three days to go from discovery to notification. That is quick by industry standards. It also means the scoping work behind the notice was short, and the company itself hedges its conclusions with "based on the information available."
Which banners are affected is not fully settled. The Prince George Citizen says More Rewards runs at Save-On-Foods and Buy-Low Foods stores. Tech-Insider says customers of four banners are affected: Save-On-Foods, Buy-Low Foods, PriceSmart Foods and Nesters. The Province lists the wider Pattison Food Group portfolio (Buy-Low Foods, Choices Markets, Nature's Fare Markets, Nesters Market, Urban Fare), but that is the group's ownership structure, not a confirmed list of affected programs. Rankiteo calls the operator the Overwaitea Food Group, a subsidiary of the Jim Pattison Group. Overwaitea is the group's former corporate name. Until the company publishes its own scope, the safest reading is that any banner tied to More Rewards may be affected.
Rankiteo also says the incident "follows an earlier breach disclosed in the same report." No other source backs this up, and it gives no details, so wasteland.me does not treat it as established.
What Was Taken
Accessed, according to the company: - Full name (every affected member) - Postal address, if provided - Phone number, if provided - Email address, if provided - Date of birth, if provided
Not accessed, according to the company: passwords, credit card data and transaction history. The email says that "your More Rewards account remains secure."
Volume: Not disclosed. Reports go from "thousands" (The Province) to Tech-Insider's point that millions of loyalty members in B.C. and Alberta cannot yet tell whether they are affected. That second figure describes uncertainty about the program's reach, not a count of exposed records. No outlet has published a verified number.
Who is in the data: Save-On-Foods requires a More Rewards profile for online shopping (CBC), so online grocery customers are especially likely to have full address records on file. One RedFlagDeals forum user said their notice included their address and guessed it came from a single online order placed about a year earlier. That is one person's account, but it fits: the program keeps fulfilment data long after the transaction.
Sensitivity: Moderate on its own, high in combination. A name, home address, phone number, email address and date of birth together make a strong set of identity-verification attributes. Date of birth is often used as a knowledge-based authentication factor by banks, telecom carriers and government services.
Why It Matters
Phishing is the immediate risk. The Canadian Centre for Cyber Security, quoted by CBC, warns that this kind of data makes phishing more convincing because attackers can impersonate trusted organizations. Attackers now know who shops at which grocery banner, where they live and how to reach them. That supports believable lures: fake More Rewards point-expiry notices, fake breach-compensation offers, and fake "verify your account" messages sent by SMS and email. The company's warning that it "will never contact you for sensitive information such as your password, verification codes, banking or payment card information, Social Insurance Number, or security question answers" is a good list of what attackers will likely ask for.
Loyalty platforms are a growing target. Retailers often secure loyalty databases less tightly than payment systems, even though they hold richer identity data. That is especially true when the loyalty database is also the identity store for e-commerce, as it is here. A few weeks earlier, 0dayNews reported that attackers used stolen API keys for the third-party Ribon loyalty apps to pull customer names, emails, phone numbers and shipping addresses from BigCommerce storefronts between September 13 and 17, 2026. No source links that campaign to the Save-On-Foods incident. The overlap in data types is coincidental as far as anyone can currently show. The point is the pattern: loyalty and rewards systems are being attacked through whatever path is easiest.
The sector is under pressure. The Food Institute, citing the Food and Agriculture ISAC, reports 227 attacks on food and beverage companies in the first half of 2026, up 62% from the same period in 2025. Zscaler's ThreatLabz describes extortion groups moving away from disruptive encryption toward quieter data theft, which fits an incident like this one, where a single server was accessed, records were taken, and stores were not disrupted. There is no evidence yet that this was an extortion operation, but defenders should keep that possibility open until it is ruled out.
The disclosure is still incomplete. The company has not given a victim count, an intrusion vector, the amount of time the attacker had before discovery, or a date for notifying regulators. Under PIPEDA and B.C.'s PIPA, those details will probably appear in regulator filings later, and the scope may grow once forensics finishes.
The Attack Technique
Not disclosed. The company has not said how the attacker reached the server, what kind of system it was (database host, application server, or third-party hosted service), whether credentials were involved, or how long the attacker was inside before the October 13 detection. Rankiteo confirms that no attribution to a threat actor or attack vector has been provided. As of publication, no ransomware or extortion group has listed Pattison Food Group or More Rewards on a leak site, according to the sources reviewed.
What the disclosure does show: - The intrusion was found while active or soon after, on a single server, and stopped by taking that server offline. That suggests detection-driven containment rather than a third-party tip-off, though the company has not said how the activity was detected. - The company says passwords and payment data were not accessed. If that is accurate, either they are stored separately from the profile data or the attacker's access was limited to the profile tables. In the BigCommerce case, passwords and payment data were also stored separately and were not in scope. - Possible vectors that match the observed data set include a compromised API or integration credential, an exposed or vulnerable web-facing application server, and abuse of a valid account. These are hypotheses, not findings.
What Organizations Should Do
- Separate loyalty PII from fulfilment and marketing systems. Keep addresses and dates of birth in a separate store with its own access controls, and apply retention limits. If a profile has been inactive for a year, it does not need a delivery address on file.
- Inventory and rotate every credential that can reach the loyalty database. That includes third-party integrations, marketing platforms and storefront apps. Scope API keys narrowly, put an expiry on them, and alert on bulk read patterns. The Ribon and BigCommerce case shows how a single integration key can expose an entire customer table.
- Detect bulk extraction, not just intrusion. Set baselines for normal query volume and row counts on customer-data servers, and alert on large SELECTs, unusual exports and outbound transfer spikes. Data-theft extortion succeeds when exfiltration goes unnoticed.
- Prepare customer-facing anti-phishing messaging in advance. Save-On-Foods' list of what it will never ask for is a good template. Publish it on your website before an incident, and authenticate your outbound email with DMARC set to enforce, so impersonation is harder after a breach.
- Stop using date of birth and address as authentication factors. If your own help desk or account-recovery flow accepts this data, a breach at any retailer weakens your controls. Move to possession-based or phishing-resistant factors.
- Plan disclosure scoping in advance. Logging that can quickly answer "which records were read" lets you notify with a count and a verified scope. Without one, customers and regulators have to wait for later updates.
Sources: Save-On-Foods loyalty program members had personal information acce... | Prince George grocery customers warned their information was hacked... | Save-On-Foods rewards system breached by hackers The Province | More Rewards Data Breach 2026: What Was Exposed | Save On Foods $1.49 Day on Tuesday, October 20 - Page 2 - RedFlagDe... | BigCommerce Merchants Breached via Ribon App Credentials — 0dayNews | Food Industry Cyberattacks Jump 62% in 2026 | Overwaitea Food Group, Jim Pattison Group and More Rewards: Selma B...