If you got the More Rewards breach email, your name, email, phone number, date of birth and possibly home address were exposed — but not your password, payment cards or purchase history. The real risk is targeted phishing, so treat any message about the breach with suspicion and place a free fraud alert with Equifax and TransUnion Canada.
What Happened in the More Rewards Breach
More Rewards is the loyalty program run by Pattison Food Group, the parent of Save-On-Foods, PriceSmart Foods, Buy-Low Foods and Nesters Market across Western Canada. According to the company's notice and reporting by Global News and iPhone in Canada:
- October 13, 2026: Pattison detected unauthorized activity on one of its servers, shut that server down, and brought in a third-party cybersecurity firm.
- October 16–17, 2026: The company confirmed that customer personal information in the More Rewards database had been accessed, and began emailing affected members and posting updates at morerewards.ca.
- Pattison says it notified the appropriate authorities and privacy regulators. It has not said how many members were affected.
What data was exposed
- Full name
- Email address
- Phone number (if you provided one)
- Date of birth (if you provided one)
- Home address (if you provided one)
What was not exposed
Based on the investigation so far, More Rewards says passwords, credit card data and transaction history were not accessed, and member accounts themselves remain secure. The company says no password reset is required.
Expect Breach-Themed Scams
Criminals know exactly who shops at Save-On-Foods now. Expect emails, texts and calls that mention More Rewards points, "account verification," or a refund for the breach. More Rewards says it will never ask for your password, verification codes, banking or card details, Social Insurance Number, or security question answers. Real emails come only from addresses ending in @morerewards.ca or @mail-morerewards.ca.
Why a "Low-Risk" Breach Still Matters
No cards or passwords sounds reassuring, but name + date of birth + address + phone is the core kit for impersonation. Your date of birth never changes, and it is one of the most common identity checks banks, telcos and government services use. Combined with details scraped from people-search sites and older breaches, it lets a fraudster pass security questions, attempt a SIM swap, or open accounts in your name. Loyalty programs are a favourite target for exactly this reason — see our breakdown of the privacy risks of loyalty programs.
Is your data already out there?
Leaked data ends up on broker sites and in scammers' hands. Run a free 60-second scan to see your exposure — then let us remove it.
Run a free scan★★★★★ 4.8/5 · Trusted by thousands of families
What to Do Right Now
Step 1: Confirm the notice is real
Don't click links in any breach email. Go directly to morerewards.ca, or call More Rewards customer service at 1-833-690-1146. The company emailed every address tied to an affected account, so some people received more than one message — check your spam folder too.
Step 2: Lock down your More Rewards account anyway
A reset isn't required, but if you reused your More Rewards password anywhere else, change it on those other sites now. Check your points balance for unexplained redemptions. If something looks off, follow our guide on what to do if a loyalty account is hacked.
Step 3: Place a free fraud alert
Western Canadian residents generally can't freeze their credit file the way Americans can, but both Canadian bureaus offer free fraud alerts that ask lenders to verify your identity before approving credit. Contact each one separately — an alert at one does not carry over to the other:
- Equifax Canada: 1-800-465-7166
- TransUnion Canada: 1-800-663-9980
While you're there, request your free credit report and look for accounts or inquiries you don't recognize.
Step 4: Harden your phone number
Your phone number was exposed, which makes SIM-swap fraud easier. Call your carrier and add a port-out PIN or account passcode. Our guide to protecting yourself from SIM swap attacks walks through it for every major carrier.
Step 5: Watch for phishing for the next six months
Breach-themed phishing usually peaks in the weeks after a disclosure and continues for months. Review the warning signs in our guide to recognizing phishing scams, and report attempts to the Canadian Anti-Fraud Centre at 1-888-495-8501.
Step 6: Take credit monitoring when it's offered
More Rewards says it is arranging credit monitoring for customers who want it and will share details once it launches. Sign up when it arrives — it's free and adds an extra alert layer — but remember that credit monitoring only spots fraud after it happens.
Check If Your Details Are Already Circulating
Stolen loyalty databases often surface on criminal forums weeks after a breach. Learn how to check if your information is on the dark web so you know whether your email and phone number are being traded.
Reduce the Data Scammers Can Combine With This Leak
A single breach is rarely the whole problem. Fraudsters stitch leaked records together with profiles from data brokers and people-search sites that publish your address history, relatives and phone numbers. Shrinking that footprint makes the More Rewards data far less useful to them.
PrivacyOn continuously removes your profile from 100+ data brokers and people-search sites, re-submits removals when listings reappear, and runs 24/7 dark web monitoring that alerts you when your email, phone or other details show up in breach dumps. Family plans cover up to 5 people, from $8.33/month. To see how PrivacyOn stacks up, read our guide to the best data removal services in 2026, then run a free PrivacyOn scan to see where your information is exposed.
Frequently Asked Questions
Was my More Rewards password stolen?
No. More Rewards says passwords were not accessed and member accounts remain secure, so a password reset isn't required. If you used the same password on other websites, changing it there is still a sensible precaution.
Which stores are affected by the More Rewards data breach?
The breach affects More Rewards members, the loyalty program shared by Pattison Food Group banners including Save-On-Foods, PriceSmart Foods, Buy-Low Foods and Nesters Market in Western Canada. Pattison has not disclosed how many members were affected.
Were credit cards or purchase history exposed?
No. According to More Rewards, credit card data and transaction history were not accessed. The exposed fields were name, email address and, where provided, phone number, date of birth and home address.
Is More Rewards offering free credit monitoring?
The company says it is working on a credit monitoring offer for customers who want it and will announce details once it is available. Until then, place free fraud alerts with Equifax Canada and TransUnion Canada.
How do I know if a More Rewards email is legitimate?
Legitimate More Rewards emails come only from addresses ending in @morerewards.ca or @mail-morerewards.ca, and the company will never ask for your password, verification codes, card details or Social Insurance Number. When in doubt, call 1-833-690-1146 directly.
What is the best way to protect myself after this breach?
Place fraud alerts, add a carrier PIN to your phone number, and stay alert for phishing. For ongoing protection, PrivacyOn's dark web monitoring alerts you when your details appear in new breach dumps, and its data broker removal cuts down the extra personal information fraudsters can pair with leaked records.