Save-On

Save-On-Foods loyalty program members had personal information accessed in cybersecurity breach

Names were accessed, possibly contact information and addresses, but no number on how many affected

A major Canadian supermarket chain has notified customers in its loyalty program that their personal information was accessed during a cybersecurity breach.

The Western Canadian grocery chain Save-On-Foods says it discovered unauthorized activity on one of its servers on Oct. 13, which was "quickly contained" before launching an investigation with a cybersecurity expert.

An email was then sent out to More Rewards customers Friday.

"We are writing to let you know about an incident involving your personal information," the email read.

Customers who received an email were told that their names and — if provided — addresses, phone numbers, email addresses and dates of birth were accessed.

CBC News asked Save-On-Foods how many customers were affected in the data breach but did not receive a number by deadline.

Save-On-Foods requires online shoppers to be signed up for the More Rewards program, which also offers members exclusive in-store discounts.

The email said "based on the information available," no other personal information, such as credit card data or passwords, was accessed.

However, the Canadian Centre for Cyber Security says personal information can be used by cybercriminals to make phishing attacks more convincing, impersonating trusted organizations to trick people into sharing sensitive information or sending money.

"Most of these break-ins are opportunistic," wrote Richard Frank, director of Simon Fraser University’s international cybercrime centre, in an email to CBC News.

He said criminals often gain access to corporate networks through employees accidentally clicking malicious links or downloading malware.

But that’s when criminals can "map the network," identify whatever they can steal to monetize, "and loyalty programs usually provide enough details to make realistic scams."

Frank explained that personal information is often used by cybercriminals to impersonate companies in emails requesting more information or containing malicious links, potentially allowing them to steal identities, banking information or credit card details.

He said criminals can use that more sensitive information to make fraudulent purchases through online stores and even cryptomarkets.

Numerous Reddit commenters on B.C. and Alberta sub-communities expressed frustration with discount systems that require customers to provide personal information through loyalty programs, arguing data like that can be sold corporately and makes them a target for cybercrime.

Several of those subreddit posts suggest that customers who received the notification and then tried to change their passwords were met with a recurring error.

More Rewards members are being told to be vigilant about suspicious calls or messages, as Save-On-Foods says it will not send any communications asking for passwords, banking information, payment information, social insurance numbers or security question answers.

In an email to CBC News, Save-On-Foods said it notified the appropriate authorities and privacy regulators.

CBC News reached out to the Office of the Information and Privacy Commissioner for B.C. to confirm whether it had been notified of the incident but did not hear back before publication.

Arden McLeod, from Vancouver, is an associate producer with CBC News. He has a passion for community storytelling, local news, and reflecting the values of B.C. He graduated from the British Columbia Institute of Technology's broadcast and online journalism program. You can reach him at Arden.McLeod@cbc.ca.