A prominent Canadian supermarket chain has informed members of its loyalty program that their personal data was compromised in a cyber attack. Save-On-Foods, a grocery chain in Western Canada, detected unauthorized activity on one of its servers on October 13, swiftly containing the breach before launching an investigation with a cybersecurity specialist. Customers enrolled in the More Rewards program received an email notification on Friday, outlining that their names, and potentially their addresses, phone numbers, email addresses, and dates of birth were accessed.
Although the exact number of affected customers was not disclosed by Save-On-Foods when queried by CBC News, the supermarket chain mandates online shoppers to be registered for the More Rewards program, which provides exclusive in-store discounts. The email sent to customers assured them that based on the available information, no sensitive data like credit card details or passwords were compromised.
Concerns have been raised by the Canadian Centre for Cyber Security regarding the potential use of personal information by cybercriminals for phishing attacks. These attacks involve impersonating trusted entities to deceive individuals into divulging sensitive information or making monetary transactions. Richard Frank, the director of Simon Fraser University’s international cybercrime center, highlighted that cybercriminals often exploit employee actions like clicking malicious links or downloading malware to access corporate networks. Loyalty programs, he noted, offer ample details that can be exploited for convincing scams.
Frank further explained that cybercriminals leverage personal information to impersonate companies in phishing emails, aiming to extract more critical data such as identities, banking details, or credit card information. This stolen information can be utilized for fraudulent transactions on online platforms and even cryptomarkets.
In response to the data breach, numerous Reddit users from British Columbia and Alberta expressed discontent with loyalty programs that necessitate the submission of personal information, citing concerns about potential corporate data selling and increased susceptibility to cybercrime. Some Reddit posts highlighted difficulties faced by customers trying to reset passwords following the breach notification.
Save-On-Foods advised More Rewards members to remain vigilant against suspicious communications, emphasizing that the company will never request passwords, banking information, payment details, social insurance numbers, or security question answers via email. The supermarket chain stated that it promptly informed relevant authorities and privacy regulators about the incident. CBC News attempted to contact the Office of the Information and Privacy Commissioner for B.C. for confirmation but did not receive a response before publication.
