Pattison Food Group says More Rewards customer data was accessed in breach

Pattison Food Group confirmed on Friday, Oct. 16, that personal information stored in its More Rewards loyalty database was accessed by an unauthorized party, and began emailing members of the program used at Save-On-Foods, Buy-Low Foods, PriceSmart Foods and Nesters Market.

More Rewards is one of the largest grocery loyalty programs in Western Canada, so the notice reaches a wide pool of shoppers. The exposed details are the kind criminals use to make phishing emails, texts and calls look convincing, even when no financial data is involved.

What happened

The company said it spotted unauthorized activity on one of its servers on Tuesday, Oct. 13, shut the server down that day and brought in an outside cybersecurity firm to investigate, Global News reported. In a statement, the company said it "confirmed Friday that customers' personal information on the More Rewards database was accessed."

According to the customer notice, the data taken from the database includes each member's name and, where the member provided them, mailing address, phone number, email address and date of birth. The company said that, based on what it knows so far, no passwords, credit card data or transaction history were accessed, and that More Rewards accounts themselves remain secure. It told customers a password reset is not required.

The company said authorities and privacy regulators have been notified, and that it is arranging credit monitoring for customers who want it, according to iPhone in Canada. Some members reported receiving the notice more than once because it was sent to every email address tied to an affected account.

What we don't know yet

Pattison has not said how many members are affected, who was behind the intrusion or how the attacker reached the server. The Vancouver Sun reported that the company did not say whether payment data or purchase history could have been reached through the affected systems. No group has publicly claimed the attack.

What to do

• Check your inbox and spam folder for the notice, and enrol in credit monitoring once the company provides details.
• Treat unexpected emails, texts or calls that mention More Rewards with suspicion. The company says it will never ask for your password, verification codes, banking or card details, Social Insurance Number or security question answers.
• Legitimate More Rewards emails come from addresses ending in @morerewards.ca or @mail-morerewards.ca. Verify anything doubtful by calling the number on the company's website, not one in the message.
• Report scam attempts to the Canadian Anti-Fraud Centre.