Last updated: October 19, 2026
The quick answer
Pattison Food Group has confirmed that someone accessed the More Rewards loyalty database used by Save-On-Foods, PriceSmart Foods, Buy-Low Foods and Nesters, exposing members’ names and, where they were provided, addresses, phone numbers, email addresses and dates of birth. The company says passwords, credit card data and transaction history were not accessed based on what it knows so far. The practical risk is targeted phishing, so treat any unexpected message about your More Rewards account with suspicion.
What happened
The company says it spotted unauthorized activity on one of its servers on Tuesday, October 13, 2026, and took that server offline the same day. It then brought in an outside cybersecurity firm to investigate. On Friday, October 16, it confirmed that personal information stored in the More Rewards database had been accessed, and it began emailing customers, according to Castanet. The company also says it is notifying the relevant authorities and privacy regulators.
More Rewards is the points program shared by several grocery chains owned by the Jim Pattison Group, with stores mainly in Western Canada. Global News and Castanet both reported the same list of exposed details. The company has not said how many members are affected, and it has not explained how the intruder got in.
| Accessed, according to the company | Not accessed, based on current information |
|---|---|
| Name | Passwords |
| Mailing address (if provided) | Credit card data |
| Phone number (if provided) | Transaction history |
| Email address (if provided) | |
| Date of birth (if provided) |
What changes for you
Your payment cards and your More Rewards login do not appear to be directly at risk. The company told Global News that member accounts “remain secure.” The problem is what criminals can do with a name, phone number, email address and birthday combined. That set of details makes scam emails, texts and phone calls far more convincing, because the sender can greet you by name and quote personal facts back to you.
Expect messages about “bonus points,” “account verification,” refunds or compensation for the breach. Birth dates are also commonly used as security answers, so it is worth reviewing any account that relies on them. Keep in mind that the investigation is still underway, and the list of exposed data could change as it continues.
What to do now
- Check your inbox for the official notice. The company has been emailing customers. Read it, but don’t click links in messages you weren’t expecting; open the More Rewards app or type the website address yourself instead.
- Never share sensitive details on request. The company warns against responding to anyone who asks for information such as your Social Insurance Number or security-question answers. Add one-time codes, passwords and banking details to that list.
- Ignore points or prize offers that arrive out of the blue. “Claim your bonus points” and “compensation” links are classic follow-up scams after a loyalty-program breach.
- Change reused passwords. Passwords were not reported as accessed, but if you use the same email and password combination on other sites, now is a good moment to change it there.
- Turn on two-step verification for your email account, since your address may now be in criminals’ hands.
- Review security questions that use your date of birth, and swap them for answers that aren’t public or easy to guess where you can.
- Be wary of phone calls. A caller who knows your name and birthday isn’t proof they work for the grocery chain. Hang up and contact the company through the details on its official website or app.
For a broader look at how these scam campaigns work, see our guide to spotting toll, package and tax scams.
Who is affected, and who isn’t
Possibly affected: anyone registered with More Rewards, the program used at Save-On-Foods, PriceSmart Foods, Buy-Low Foods and Nesters. Because the company hasn’t published a member count, the safest assumption is that your details could be included if you have an account.
Less likely to be affected: shoppers who never signed up for More Rewards. The company has also said that card data and purchase history were not accessed, so paying at the till with a card is not, on current information, part of this incident. Retail breaches have been frequent this month; our coverage of the Burger King Japan app breach and the ASOS breach follows the same pattern of protective steps.
FAQ
Were my More Rewards points or payment card stolen?
The company says credit card data and transaction history were not accessed and that accounts remain secure. Keep an eye on your points balance and card statements anyway, and report anything unusual.
Do I need to delete my More Rewards account?
Not necessarily. Deleting it now won’t undo this exposure. If you rarely use the program, though, removing optional details such as your birth date or closing the account reduces what is stored in the future.
How many people were affected?
The company had not disclosed a number as of October 19, 2026. We’ll update this article if it does.
Leave a Reply