October 16, 2026: Pattison Food Group, operator of Save-On-Foods, Buy-Low Foods, PriceSmart, and Nesters grocery chains in western Canada, disclosed a breach of its More Rewards loyalty program. Unauthorized access was detected October 13, and the affected server was immediately shut down. Exposed data: customer names, addresses, phone numbers, email addresses, and dates of birth across an undisclosed number of cardholders. Canonical: more-rewards-breach2026. Source: Tech.co.
What happened
On October 13, 2026, Pattison Food Group's monitoring systems detected unauthorized access to a server supporting the More Rewards loyalty program. The company immediately isolated and shut down the affected server to prevent further access. A third-party cybersecurity firm was engaged to conduct forensics. The incident was disclosed publicly on October 16, three days after detection. The specific attack vector has not been disclosed — it could have been compromised credentials, unpatched software, misconfigured access control, or another method entirely. Pattison is notifying affected customers directly and offering identity-theft monitoring.
Technical analysis
The More Rewards system operates as a unified loyalty database backend for four grocery chains: Save-On-Foods (primary chain), Buy-Low Foods, PriceSmart, and Nesters. A single breach in the shared backend affects members of all four banners simultaneously. This is a common architecture in retail, where a holding company operates multiple brands under one IT infrastructure.
Data exposed: Names, addresses, phone numbers, email addresses, dates of birth. NOT exposed: Payment card data (kept in separate payment systems), hashed passwords, Social Insurance Numbers, or financial account details.
The separation of loyalty data from payment processing is a security best practice that partially mitigated this breach. Attackers cannot directly charge victims' credit cards. However, the combination of name, address, birthdate, phone, and email is highly valuable for identity theft, phishing, and account takeover via email password reset.
Impact
Scope: More Rewards cardholders in British Columbia, Alberta, Saskatchewan, and Manitoba where Pattison operates. The program likely serves millions of active members — Save-On-Foods alone operates over 160 stores. The exact affected customer count has not been disclosed; the company is notifying individuals directly.
Risks to victims: Identity theft and fraud (attackers can use name, address, and birthdate to open accounts in victims' names or impersonate them in phone calls to banks). Phishing (attackers send convincing emails pretending to be Pattison, asking users to "verify" accounts). Email account takeover (attackers use the breached email address to reset passwords on other sites). Social engineering (attackers have enough information to sound credible in calls to customer service). Credential reuse (if you used the same password for More Rewards as for email or banking, your other accounts are at risk).
What to do
- Watch for phishing — ignore unsolicited emails or calls claiming to be from Pattison. Visit official websites directly (saveonfoods.com, pattisonfood.com). Legitimate notifications come from Pattison's official channels, not random emails.
- Monitor credit reports — check for fraudulent accounts using free services like Equifax Canada or TransUnion. Many issuers also offer free annual credit reports.
- Consider a credit freeze — lock your credit with major bureaus if you're concerned about identity theft. This prevents criminals from opening new accounts in your name.
- Use unique passwords — if you reused your More Rewards password for email, banking, or other sites, change those passwords immediately.
- Enable MFA on email — add multi-factor authentication to prevent email account takeover, which cascades to password resets on other services.
- Monitor your loyalty account — periodically check your More Rewards account for unauthorized redemptions or profile changes.
Related reading
See identity theft prevention guidance.
Sources
Tech.co data-breach tracker • Pattison Food Group official statement