October 18, 2026 Insights 7 min read

Save-On-Foods Data Breach: Why Canadian Businesses Should Rethink Customer Data Collection

By Cybersecurity Canada Editorial Team | Published October 18, 2026

Save-On-Foods, a Western Canadian grocery chain, began notifying More Rewards customers by email on Friday, October 16, 2026, that its loyalty database was accessed by an unauthorized party. According to the company's notice, the Save-On-Foods data breach exposed customer names and, where provided, mailing addresses, phone numbers, email addresses, and dates of birth. The company says no passwords, credit card data, or transaction history were accessed, and that More Rewards accounts remain secure. For Canadian small and mid-sized businesses that maintain customer lists or loyalty programs, this incident is a prompt to ask: do you need to collect all the data you are collecting?

What Happened in the Save-On-Foods Data Breach?

Save-On-Foods discovered unauthorized activity on one of its servers on October 13, 2026, according to the company's public update. The company says it shut the server down the same day, engaged a third-party cybersecurity expert, and notified authorities and privacy regulators. CBC News and Global News both reported on the incident, corroborating the timeline and the categories of data involved.

More Rewards is the loyalty program for Save-On-Foods, Buy-Low Foods, PriceSmart Foods, and Nesters stores across Western Canada. The company has not disclosed how many customers were affected. It emailed affected customers on Friday, October 16, and says it is working to make credit monitoring available.

Why Does Contact Data Plus Date of Birth Matter?

Businesses sometimes assume that if passwords and credit cards were not accessed, the breach is minor. That assumption is wrong. A combination of name, address, phone number, email, and date of birth is exactly what attackers need to make phishing and social engineering attacks convincing.

Date of birth is a particularly valuable data point. As AARP's fraud guidance explains, "With your name, address and birth date in hand, scammers may be able to buy your Social Security number on websites that normally sell them to businesses conducting background checks." Date of birth is also commonly used by banks and other services to verify identity over the phone or during password recovery. An attacker who knows your birthday can often pass those checks or craft a phishing message that feels credible because it includes accurate personal details.

Security researcher Joseph Bonneau and colleagues found that knowing a victim's birthday allows a thief to guess banking PINs successfully in roughly one of every 11 to 18 stolen wallets, since many people use their birthdate as their PIN. Even when PINs are not the target, date of birth combined with other breached data increases the probability of successful fraud.

As CBC News reported, the Canadian Centre for Cyber Security says personal information can be used by cybercriminals to make phishing attacks more convincing. Richard Frank, director of Simon Fraser University's international cybercrime centre, told CBC News that "loyalty programs usually provide enough details to make realistic scams."

Does Your Business Need to Collect Date of Birth at All?

This is the data minimization question every Canadian business with a customer database should ask. PIPEDA's Schedule 1, clause 4.4 (Principle 4, Limiting Collection) states: "The collection of personal information shall be limited to that which is necessary for the purposes identified by the organization."

The Office of the Privacy Commissioner of Canada's self-assessment guidance puts it more directly: "Information should not be collected on the basis that it might prove useful in the future."

Many loyalty programs ask for date of birth to send birthday discounts. That is a marketing convenience, not a necessity. If your business collects date of birth for a similar reason, weigh the benefit against the liability. Every data field you collect becomes a data field you must protect and, if breached, a field that can harm your customers.

The OPC's guidance notes that "Collecting less information also reduces the risk and/or impact of loss or inappropriate access, use or disclosure." This is not abstract compliance advice. The Save-On-Foods incident is a concrete example: the company says it collected dates of birth only "where provided," but for customers who did provide that data, the exposure is now real.

What Are Your PIPEDA Breach Notification Obligations?

If your Canadian business experiences a breach, PIPEDA section 10.1 requires you to determine whether there is a "real risk of significant harm" (RROSH) to individuals. If there is, you must:

1. Report to the Office of the Privacy Commissioner of Canada as soon as feasible after determining the breach occurred. The OPC's breach reporting guidance outlines the required content.
2. Notify affected individuals directly (by email, mail, phone, or in person). The notification must describe the circumstances, the information affected, what you are doing to reduce harm, what individuals can do to protect themselves, and how to contact you for more information.
3. Keep records of every breach for at least 24 months, regardless of whether it met the reporting threshold. This requirement comes from the Breach of Security Safeguards Regulations, section 6(1).

"Significant harm" under PIPEDA includes identity theft, financial loss, damage to reputation or relationships, loss of employment or business opportunities, and negative effects on credit records. The factors for determining real risk include the sensitivity of the information and the probability that it has been, is being, or will be misused.

A breach involving names and dates of birth may meet this threshold even if credit cards were not accessed. The OPC provides an online tool to help organizations assess RROSH.

How Should Canadian Businesses Respond to This Incident?

The Save-On-Foods breach is a reminder for any Canadian SMB that maintains a customer list, loyalty database, or membership program. Use it as a prompt to review your own practices.

1. Audit what you collect. List every field you store for customers or members. For each field, ask: do we have an identified purpose for this? Is the purpose necessary or merely convenient?

2. Eliminate what you do not need. If you collect date of birth only to send birthday emails, consider whether you could ask for just the month and day (or stop asking entirely). If you collect mailing addresses but never send physical mail, stop collecting them.

3. Review your breach response plan. Do you have a documented process for assessing RROSH, notifying the OPC, and contacting affected individuals? If not, the time to build one is before a breach, not after. Our guide to building an incident response plan provides a starting point.

4. Train your staff. Employees who handle customer data should understand what data you collect, why, and what to do if they notice something suspicious. See our page on security training for the Canadian Centre for Cyber Security's baseline expectations.

5. Warn your customers before the fakes arrive. Save-On-Foods' notice tells customers to "remain cautious of unusual or unexpected emails, text messages or phone calls." If your business ever needs to send a breach notification, include explicit guidance on what a legitimate message from you will and will not ask for. This reduces the window for phishing campaigns that impersonate your notice.

The Question to Put to Your IT Lead

Before your next customer record is entered, ask: "Which fields in our customer database are strictly necessary for our business purposes, and which are we collecting out of habit or marketing convenience?"

If the answer reveals data you do not need, remove the fields. If you are not sure which fields you have or where they are stored, you have a more fundamental problem to address first.

Our free cybersecurity assessment evaluates your organization against the Canadian Centre for Cyber Security's Baseline Controls, including access control and incident response. It runs entirely in your browser, collects no data, and gives you a prioritized view of where your security posture needs attention.

Frequently Asked Questions

Cite This Page

Suggested citation:

Cybersecurity Canada (2026). Save-On-Foods Data Breach: Why Canadian Businesses Should Rethink Customer Data Collection. Retrieved from https://cybersecuritycanada.ca/news/posts/save-on-foods-data-breach-customer-data-minimization-lessons/

Permanent URL: https://cybersecuritycanada.ca/news/posts/save-on-foods-data-breach-customer-data-minimization-lessons/ · Published October 18, 2026