More Rewards Breach: Is Your Loyalty Program the Weak Spot?

On this page 7 sections

1. What Happened in the More Rewards Data Breach
2. Why Attackers Target Loyalty Databases Instead of Card Data
3. What PCI DSS Covers and What It Leaves Out of Your Rewards Program
4. Collect Less: Cut Down the Customer Data You Store
5. Vetting Loyalty and CRM Vendors: Security Questions to Ask
6. If a Loyalty Program Data Breach Hits: Notification and Phishing Follow-Up
7. Next Steps: A Quick Loyalty Data Checkup

Key takeaways

• More Rewards, the loyalty program for Save-On-Foods, confirmed on October 16, 2026, that member names and contact details had been accessed. The company said card data was not.
• PCI DSS protects payment card data. Loyalty records like names, emails and birthdates usually need their own safeguards.
• The best defense is collecting less, limiting who can see and export customer data, and holding loyalty and CRM vendors to clear security terms.
• Have a breach plan ready that covers forensics, legal review of notification duties and warnings to customers about phishing.

On Friday, October 16, 2026, More Rewards emailed its members to say their personal information had been accessed. More Rewards is the loyalty program behind Save-On-Foods and several other Western Canadian grocery chains. According to the company, no card numbers were taken. That's the lesson for U.S. merchants: a loyalty program data breach can expose your customers even when your payment systems are locked down. This guide covers what happened, why rewards databases appeal to attackers, where PCI DSS stops, and what to do: collect less data, vet your vendors and be ready to respond if customer data is exposed.

What Happened in the More Rewards Data Breach

Here is what the company and Canadian news outlets had reported as of October 18, 2026:

The company said the attacker accessed members' names and, where members had provided them, addresses, phone numbers, email addresses and dates of birth. In a statement to Global News, it said passwords, credit card data and transaction history were not accessed and that member accounts remain secure.

According to iPhone in Canada, More Rewards said members don't need to reset their passwords and that it has notified authorities and privacy regulators. It had not said how many customers were affected. The program covers shoppers at Save-On-Foods, Buy-Low Foods, PriceSmart Foods and Nesters Market. The same outlet noted that this Save-On-Foods breach follows the Canadian Tire breach last year and a Loblaw network breach in March.

The reports we reviewed didn't say how the attacker got in. Treat early accounts as incomplete, because details often change as investigations continue.

Why Attackers Target Loyalty Databases Instead of Card Data

You don't need a trend report to see why a loyalty database is worth breaking into. Look at what it holds and how it's usually protected.

• Card data is hard to get. EMV chips and tokenization mean many small merchants never store card numbers at all, and card data gets strict security attention. Customer databases often get much less.
• Identity data lasts. A stolen card can be canceled and reissued. A birthdate or home address can't be.
• It makes phishing believable. A name, email, phone number and a real store relationship are all a scammer needs for a convincing "your points are about to expire" message.
• Points are worth money. Points, credits and stored rewards can be redeemed. At many registers, all it takes to use an account is a phone number.
• There are many ways in. Loyalty data often sits in the POS, a mobile app, an online store, an email platform and a CRM, plus whatever spreadsheet someone exported last spring.

A loyalty database hack doesn't need to touch card data to hurt your customers or your reputation.

What PCI DSS Covers and What It Leaves Out of Your Rewards Program

PCI DSS is the card industry's security standard for protecting payment card data wherever you store, process or send it. It's essential. But it was built to protect card data, not your whole customer file.

Two cautions:

1. Card-linked loyalty can pull your loyalty system under PCI DSS. If your program looks members up by card number, or your loyalty platform stores card data, those systems may fall under the standard. Ask your processor or a qualified security assessor to confirm. Never use a card number as a loyalty ID.
2. Passing your PCI questionnaire doesn't mean your customer database is safe. Many owners treat the annual self-assessment as their whole security program. For customer loyalty data security, it's only the starting point.

If you're replacing or upgrading POS systems, ask how the loyalty module stores member data and whether it's kept separate from payment data.

Collect Less: Cut Down the Customer Data You Store

Data you never collected can't be stolen. For protecting customer data, a small business can get the most out of a quick look at its sign-up form.

Then set a retention schedule: delete or anonymize accounts that have been inactive for a set period, and delete one-time exports once a campaign ends. If you're designing a program from scratch, our guide on how to start a customer loyalty program that pays for itself shows how to build rewards around the data you actually use. To compare formats, see our guide to choosing between points, punch cards and tiered loyalty models.

Grocery Markets

Busy lanes depend on fast phone-number lookups, so anyone who knows a number can often use the account. Show only part of the number on the customer-facing screen. Consider an extra check before someone redeems a large balance. If you're reviewing hardware, our breakdown of grocery store POS systems with scales, PLUs and EBT covers what to look for, and our grocery market payment solutions page covers the processing side.

Retail Stores

Retailers often merge online accounts and in-store profiles into one customer file. That's convenient, but it means one breach exposes both channels. Offering guest checkout cuts down on stored accounts. See guest checkout vs. forced accounts for the tradeoffs. More on in-store acceptance is on our retail industry page.

Restaurants and Bars

Online ordering, reservations, birthday clubs and text-message offers all build guest profiles. Allergy and dietary notes are useful for service, but limit who can see them and leave them out of marketing exports. Our restaurant and bar payment processing page covers POS and ordering setups.

Health and Beauty

Salons, spas and barbershops keep client cards with service history, color formulas, skin sensitivities and sometimes photos. Treat these as sensitive and record only what the service requires. Businesses that offer medical-adjacent services may have additional obligations, so check with a qualified professional. See our health and beauty merchant services page for terminal and booking options.

Lock Down Access

• Give staff roles that match their jobs. Cashiers shouldn't be able to export the customer list.
• Turn on multifactor authentication for every admin login and email account.
• End shared logins and remove former employees' access the day they leave.
• Train staff on pretext calls. Attackers often just ask for access. Our article on social engineering lessons for merchants walks through real tactics.

Vetting Loyalty and CRM Vendors: Security Questions to Ask

Most small merchants run loyalty through a vendor, so that vendor's security is effectively your security. Ask these before you sign, and again at renewal:

1. Where is our customer data stored, and is it encrypted both in storage and in transit?
2. Do you support multifactor authentication and role-based permissions for our staff?
3. Can we limit or turn off bulk exports, and do you keep logs of who accessed or exported data?
4. Can you share independent security assessments, such as a SOC 2 report or penetration test summary?
5. Which subcontractors can access our data?
6. How quickly will you notify us of a security incident, and is that timeline in the contract?
7. Does the platform store or touch card data? If so, how does that affect our PCI DSS obligations?
8. How are API keys and integrations with our POS, online store and email tools secured?
9. Can we set retention rules and delete inactive members automatically?
10. What happens to our data when the contract ends, and will you confirm deletion in writing?

If you get vague answers to questions 3, 6 or 10, slow down. The same approach works for payment providers too; see how to choose a merchant service provider. MannyPay supports POS and software integrations including Clover POS, Shopify, QuickBooks and Salesforce. Ask how customer data moves between whichever tools you connect.

If a Loyalty Program Data Breach Hits: Notification and Phishing Follow-Up

Contain and Investigate

The Federal Trade Commission's Data Breach Response: A Guide for Business recommends these first steps:

• Put together a response team that includes forensics, legal, IT and communications.
• Stop further data loss.
• Update compromised credentials.
• Preserve evidence.
• Review your service providers and how your network is segmented.

Figure Out Your Notification Duties

U.S. states have their own breach notification laws. Whether a loyalty-only breach requires notice depends on what data was exposed and where your customers live. Some health-related businesses face separate federal rules, which the FTC guide covers. Talk to an attorney before you send anything. This section is general information, not legal advice.

When you do notify customers, the FTC suggests:

• Ask law enforcement about timing so your notice doesn't interfere with an investigation.
• Name one point person to release information.
• Explain clearly what happened, what information was taken and what customers should do.
• If you hold data on behalf of other businesses, notify them as well.

Get Ahead of Phishing

Exposed contact details are a ready-made phishing list, so warn customers before scammers reach them:

• Post the notice on your website so customers can confirm any message is really from you.
• Tell customers exactly what you will never ask for, such as passwords, card numbers or verification codes.
• Watch for unusual points redemptions and for changes to account contact details.
• Prepare staff for calls from people claiming to be customers who want an account updated.

Illustrative example: "We will never call, text or email asking for your password, card number or a verification code. If you receive a message like that using our name, don't respond. Contact us directly at the number on our website."

Next Steps: A Quick Loyalty Data Checkup

1. List every system that holds customer data, including spreadsheets.
2. Remove one field you don't need, starting with birth year or home address.
3. Turn on multifactor authentication for admin and email accounts.
4. Restrict exports and review who has admin rights.
5. Send your loyalty vendor the questions above.
6. Write a one-page breach contact list covering your attorney, IT help, vendor and processor.

The More Rewards incident is still under investigation, so watch for updates. Your loyalty data checkup doesn't have to wait for them. If you're reviewing your POS or payment setup at the same time, request a free quote. A MannyPay specialist responds within one business day.

Sources

1. More Rewards Data Breach: What Save-On-Foods Shoppers Should Do Now (iPhone in Canada)
2. More Rewards customer data accessed in cybersecurity breach, Pattison Food Group says (Global News)
3. Save-On-Foods loyalty program members had personal information accessed in cybersecurity breach (CBC News)
4. Grocery customers warned their information was hacked (Prince George Citizen)
5. Data Breach Response: A Guide for Business (Federal Trade Commission)

ME

About the author

MannyPay Editorial Team

Beyond the Swipe's editorial desk researches the publication's guides and news and cites its sources in every article. Articles reviewed by a named MannyPay editor carry that editor's byline.

This article is for general educational purposes and is not legal, tax or financial advice. Card network rules and state laws change; confirm current requirements for your business.