The email lands on a Friday evening. It has your name on it, and it says your address, your phone number, your email address and your date of birth were accessed. That is the real More Rewards data breach notice. Then on Monday a second message arrives, also with your name and your birthday in it, asking you to confirm your account before your points expire. From the inbox alone, nothing tells you which of the two companies actually sent it.
Confirmation: confirmed by Pattison Food Group, which emailed members on Friday 16 October 2026.
What happened in the More Rewards data breach
Pattison Food Group runs the More Rewards loyalty program across Save-On-Foods, Buy-Low Foods, PriceSmart Foods and Nesters Market, almost all of it in western Canada.
The company’s account of the timeline is short and dated. Its team found unauthorized activity on one of its servers on 13 October. It shut that server down the same day and brought in a third-party cybersecurity expert. Then, on 16 October, it confirmed that customer personal information in the More Rewards database had been accessed. The company emailed members that evening, and a notice went up on the More Rewards site.
Nobody outside the investigation has described how the attacker got in, so nobody can yet name the door that was open. Reporting says Pattison has also notified authorities and privacy regulators, although that line does not appear in the statement the company gave to Global News.
What the More Rewards data breach exposed, and what each item is worth
The company names four things beyond your name, each of them conditional on your having given it: address, phone number, email address, and date of birth.
- Email address. This is the delivery route for everything else on the list.
- Home address. It makes a fake message read as a system that already knows you.
- Phone number. So the follow-up does not have to arrive by email at all.
- Date of birth. This is the quiet one, and it is the reason this set matters more than its length suggests.
Date of birth is one of the standard questions a call center asks to confirm who it is talking to. Home address is another. The set that left the More Rewards database is close to the set a stranger needs to pass that check somewhere else, which is a different problem from losing a points balance.
Pattison’s own advice points the same way. It tells customers to be careful if anyone contacts them asking for sensitive information such as a social insurance number or the answers to security questions.
Why grocery loyalty mail is unusually good cover
People who shop at Save-On-Foods expect email from More Rewards. Points balances, weekly offers, birthday coupons, a bonus-points event. That expectation is the material an attacker works with, because a message does not have to be alarming to be opened. It only has to look routine.
Add the exposed fields and the fake version gets specific. It can use your name, reference the city you live in, and wish you a happy birthday in the week you actually have one. Ordinary phishing mail rarely manages any of that.
What the company says was not taken
Pattison is specific about the limits of this one. Its notice says no other personal information was accessed, and it names passwords, credit card data and transaction history. It also says More Rewards accounts themselves remain secure.
One local outlet, Fraser Valley News Network, reported that members read their notification as mentioning account passwords. That contradicts the company’s own wording in the same email, and no other outlet carries it, so treat it as unverified. Change that password anyway if you used it on other sites. A reused password is worth fixing in a quiet week as well as in this one.
How many people were in the More Rewards data breach?
Pattison has not published a number of affected members, and nothing in the reporting supplies one.
What is public is the size of the program rather than the size of the breach, and those are different figures. More Rewards describes itself as having more than 3.5 million members across western Canada. That is a ceiling, not a count. In short, the scope is still open, so any number going around this week is somebody’s estimate until the company or a privacy regulator publishes one.
What to do now
Most of this has nothing to do with us.
- Treat any More Rewards or Save-On-Foods message as a notification, not an instruction. Read it, then open the app or type the company’s address yourself to check whatever it claims.
- Expect a phone call and a text as well as email, because phone numbers were in this set.
- Be careful with identity questions. A caller who already knows your name, address and birthday can sound official while asking for the pieces they are missing.
- Watch for the birthday lure. Dates of birth are in the data, so “your birthday reward is waiting, confirm your details” is the obvious build.
- Use a password manager so one password does not exist on a dozen other sites.
- Turn on the strongest sign-in each of your accounts offers, which usually means a passkey or an authenticator app ahead of SMS codes.
- Check the sender’s full address, not the display name. A convincing fake uses the right name and a domain that is close but wrong.
How OptMsg changes this exposure
We want to be careful here, because this breach happened at another company, and nothing on our side would have changed what left their servers.
What changes is the next step, on your side. Mail from a sender you have not approved goes to Trash rather than your Inbox, and auto-deletes after 30 days. So the fake More Rewards notice built from this data arrives in Trash instead of sitting next to the real one, and you decide which senders reach you rather than judging each message as it lands.
Your OptMsg account also has no password, so a password stolen from another site can’t open your inbox. Because your email is how most accounts get reset, keeping that door shut keeps the rest shut with it.
Here is what the argument does not cover, stated plainly. It does nothing about a compromised device, a live phishing page you type your details into, or somebody holding your unlocked phone. The claim is narrow on purpose, and it is still worth having, because a password that does not exist cannot be stolen or stuffed. Our simple by design page explains how the approved-sender part works.
Want an inbox where a breach at the grocery store does not become your Monday morning? Create your OptMsg account and pick your address while the good ones are still free to choose.
Create Your Account
Your Inbox. Your Rules.
Frequently asked questions
Q: What was exposed in the More Rewards data breach? A: Pattison Food Group says the accessed information includes your name and, if you provided them, your address, phone number, email address and date of birth. It says passwords, credit card data and transaction history were not accessed.
Q: How many More Rewards members are affected? A: The company has not said. More Rewards reports more than 3.5 million members across western Canada, but that is the size of the program and not a count of affected people.
Q: Which stores are involved? A: The More Rewards program runs across Save-On-Foods, Buy-Low Foods, PriceSmart Foods and Nesters Market, all part of Pattison Food Group.
Q: Do I need to change my More Rewards password? A: The company says passwords were not accessed and that accounts remain secure. One local outlet reported members reading their notice differently, so if you used that password anywhere else, change it on those sites too.
Q: How do I tell the real notification from a fake one? A: Often you cannot, from the inbox alone, and that is the problem. Read any such message as a prompt to go and check for yourself, then reach More Rewards by opening the app or typing the address in yourself.
Sources
- Global News, “More Rewards customer data accessed in cybersecurity breach, Pattison Food Group says”, Amy Judd, 17 October 2026 — https://globalnews.ca/news/12106695/more-rewards-customer-data-accessed-cybersecurity-breach-pattison/
- Fraser Valley News Network, “More Rewards Program (Specifically Pattison Foods/Save On Foods) Cyber Hack”, 16 October 2026 — https://fraservalleynewsnetwork.com/2026/10/16/more-rewards-program-specifically-pattison-foods-save-on-foods-cyber-hack-customer-info-compromised/
- Canadian Grocer, “Pattison Food Group bolsters rewards program with RBC partnership” — https://canadiangrocer.com/pattison-food-group-bolsters-rewards-program-rbc-partnership
Previous in Breach Breakdown: Burger King Japan Will Email 11 Million People About a Breach of Their Email Addresses
Next in Breach Breakdown: One Stolen Login Exposed Millions of California Students in the ETS Data Breach
