A Kelowna man is asking B.C. Supreme Court to certify a class action against Pattison Food Group Ltd. over the More Rewards data breach that hit Save-On-Foods and other Western Canada grocery loyalty members earlier this month.
Clint Docken filed the proposed lawsuit on October 27, according to the Kelowna Daily Courier. The claim names Pattison Food Group, which runs Save-On-Foods, Buy-Low Foods, PriceSmart Foods, Urban Fare, Nesters Market, Choices Markets and related chains, not Jim Pattison personally. The allegations have not been proven in court, and filing the case does not mean it has been certified.
More Rewards told customers that an unauthorized third party accessed a server holding its loyalty database on or about October 13. The company says it shut that server down the same day and hired outside cybersecurity help. Notices to members listed names, addresses, phone numbers, email addresses and dates of birth as accessed. Passwords, credit card details and transaction history were not accessed, based on the information available to the company at the time.
Docken’s claim says the company has not disclosed when the unauthorized access began, how the third party got in, whether the data was copied, or how many members were affected. More Rewards reported more than 3.5 million household members in 2024, but the number touched by this incident remains unknown. The lawsuit argues that mix of personal details can feed identity theft, impersonation and targeted scams, the same risk that has driven other Canadian retail warnings, including the recent Loblaw breach notices sent to shoppers.
Dates of birth are especially hard to walk back once they leak, because they rarely change and are often used to verify who you are. Scammers who already know your name, phone number and email can make a fake call or text look far more convincing, a pattern Toronto police have also flagged as AI-aided impersonation scams rise.
The claim also raises questions about Pattison Food Group’s partnership with Royal Bank of Canada on co-branded More Rewards Visa cards and a program that lets customers link RBC cards to loyalty accounts. Under that arrangement, the grocery company receives some credit card transaction information from the bank. Docken says it is not known whether information received from RBC, or data tied to linked cards, sat on or was reachable from the compromised server.
Among other claims, the lawsuit alleges the company failed to use adequate technical and administrative safeguards, access controls, encryption and monitoring, and that it kept personal information for inactive and former members longer than necessary. Docken is seeking damages for himself and the proposed class, at least five years of credit monitoring and identity theft protection, stronger security practices, and the deletion or anonymization of personal information the company no longer needs.
The proposed class would cover people whose personal information was stored in the More Rewards database accessed during the breach, or alternatively people who received notice that their information had been accessed. If the court certifies the proceeding, others who meet the eventual class definition could join and potentially receive compensation.
Anyone who got a More Rewards notice should treat unexpected emails, texts or calls that ask for passwords, codes, banking details or a Social Insurance Number as suspicious until verified through a contact method already known to be legitimate. More Rewards has said it is working on credit monitoring for customers who want it.
Did you get a More Rewards breach notice, and would you join a class action if one is certified?
Want to see more of our stories on Google?
P.S. Want to keep this site truly independent? Support us by buying us a beer, treating us to a coffee, or shopping through Amazon here. Links in this post are affiliate links, so we earn a tiny commission at no charge to you. Thanks for supporting independent Canadian media!
