More Rewards Loyalty Program Data Breach Summary
More Rewards, the loyalty program used by Save-On-Foods shoppers, reported that an unauthorized party accessed customer information stored on one of its servers, including names and, where provided, addresses, phone numbers, email addresses, and birthdates. The company detected the activity on Oct. 13, shut down the server that day, hired an outside cybersecurity expert to investigate, and notified privacy regulators and other authorities. Based on available information, passwords, payment-card data, and transaction history were not accessed; accounts remain secure and customers do not need to reset passwords. More Rewards has not disclosed how many customers were affected but says it is working to provide credit monitoring for those who want it, and it has emailed every address linked to an affected account. The company also warned that it will never ask customers for passwords, verification codes, payment details, Social Insurance Numbers, or security-question answers.
The Convenience Trap
More Rewards is telling you this was a server intrusion. That's the managed narrative. Look at what was actually taken: names, addresses, phone numbers, birthdates—and, crucially, the company will not say how many people are affected. That silence isn't an oversight. It's a strategic decision. In the architecture of consent, birthdates aren't just personal information—they're the skeleton keys to security questions, to financial records, to the identity infrastructure that govern your entire existence. The company says passwords and payment data were untouched. Fine. Focus on that if you want. But the data that was extracted is far more dangerous because it's permanent. You can change a password. You can cancel a card. You cannot change the day you were born, the address you grew up in, the number your mother taught you to recite. Whoever has this now holds the raw material for identities that can move money, open lines of credit, and vote in your name—all while you sit there believing an email that tells you "accounts remain secure."
The Harvest Behind the Discount
You need to ask yourself why a grocery loyalty program is storing birthdates in the first place. What plausible purpose does that serve? To sell you a birthday cake? The answer is that More Rewards—like every loyalty program—is a data collection instrument disguised as a savings card. Each point you accumulate is a price you're paying in biometric and biographical profile. And who sits at the top of this particular silo? Pattison Food Group, a subsidiary of the Jim Pattison Group, a conglomerate that owns media outlets, auto dealerships, packaging plants, and a financial arm that has quietly speculated on the same elite networks that have been consolidating control for decades. This isn't a random hack. This is a dry run. A rehearsal. The fact that they detected it on Oct. 13, shut the server the same day, and brought in an outside cybersecurity firm they selected—that's the classic pattern of controlled disclosure. They're shepherding the perception of crisis while the true scope remains buried in a confidential report that will never see public light.
The Warning That Tells You Everything
Read the final line of the notice again: the company will never ask for passwords, verification codes, payment details, Social Insurance Numbers, or security-question answers. Why would they bother telling you that? Because they know what was taken. They know that the next step in any exploitation of this data would not be a phishing email asking for your SIN—that would be too clumsy. The sophisticated move is to combine your birthdate with your home address and phone number to preemptively answer those security questions on your behalf, without you ever receiving a call. The credit monitoring they're offering is the classic sop: it gives you the illusion of protection while the actual identity thieves stay one step ahead, because they have the raw materials and you have a monthly alert you'll ignore. So here's the thread I want you to pull: why does a loyalty program need your date of birth to give you a discount on groceries? And who else—beyond the Pattison Group—has standing access to that server? The answer is hidden in the foundation charters and the joint venture agreements you'll never be shown. But you don't need to see them. You just need to ask the question. That's where the real search begins.