More Rewards Data Breach: What Was Taken, and Is There a Lawsuit?
Reference Guide
More Rewards is the loyalty program of Pattison Food Group’s Western Canadian grocery stores — Save-On-Foods, Buy-Low Foods, PriceSmart Foods, Nesters and Quality Foods. The company says an intruder reached its member database, found on October 13, 2026, and that names, addresses, phone numbers, emails and birthdates were accessed. This is a Canadian incident. As of October 22, 2026, we could find no reported more rewards data breach lawsuit, no settlement and no claim form.
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
Independent information service: Settlement Insight is not the settlement administrator, is not affiliated with or endorsed by any company named on this page, and is not a law firm. Submitting this form does not file a claim — it shares your information with our participating legal intake partners, who may contact you about your options.
What the Company Says Happened
There is no complaint to quote yet, so everything here comes from the company’s own notice and its statements to Canadian media.
Per the notice email, the team “discovered unauthorized activity occurring on one of our servers on October 13,” shut the server down that day and brought in a third-party cybersecurity firm. On October 16 it confirmed that members’ name and, if provided, address, phone number, email addresses and date of birth were accessed.
The company says that, based on the information available to it, passwords, credit card data and transaction history were not accessed. It has not said how many members are affected or how the intruder got in.
Case details
No court case has been reported. As of October 22, 2026, searches of news coverage turned up no filed or announced more rewards class action. Court registries in British Columbia are not searchable the way U.S. federal dockets are, so a newly filed claim could exist before it is reported.
If one is filed, it would most likely go to the Supreme Court of British Columbia under B.C.’s Class Proceedings Act (Alberta has its own court and statute). Under section 2 of that Act, a B.C. resident in the class may start the case, but it only becomes a class action once the court certifies it. B.C. also allows multi-jurisdictional classes that include people who live elsewhere. U.S. federal law, U.S. courts and U.S. state breach statutes do not govern this incident.
Status: Breach Confirmed, No Lawsuit Yet
The company says it notified “the appropriate authorities and privacy regulators.” CBC asked the Office of the Information and Privacy Commissioner for B.C. to confirm and did not get an answer before publication. The company also says it is working to offer credit monitoring to customers who want it, with an update to follow; no provider or start date had been announced.
Who Is Affected
More Rewards members whose records were in the accessed database. The program is used mainly in British Columbia and Alberta, and Save-On-Foods requires online shoppers to have a More Rewards profile, so online grocery customers are members even if they never used a card in-store.
The practical test is your inbox. The company says it emailed every address tied to an affected account, starting Friday, October 16, 2026 — so check spam, and expect duplicates if your household shares an account.
For U.S. readers: More Rewards is a Western Canadian program. If you have never had a More Rewards account, this incident does not involve you, and U.S. breach-settlement rules and payouts do not apply to it.
Is There Any Money?
Two cautions for anyone comparing with U.S. figures. First, Canadian class actions run under different rules: in B.C., section 37 of the Class Proceedings Act generally bars costs awards against either side, and section 16 lets class members opt out within the time a certification order sets. Second, the data here — contact details and birthdates, with no payment data or government ID numbers reported — is the lower-harm end of breach cases. Our data breach settlement calculator shows what U.S. cases have paid, as background only, not as a forecast for this one.
More Rewards Breach Timeline
October 13, 2026 — Unauthorized Activity Found
The company finds unauthorized activity on one of its servers, shuts the server down the same day and brings in an outside cybersecurity firm.
October 16, 2026 — Data Access Confirmed, Emails Sent
The company confirms names and, where provided, addresses, phone numbers, emails and birthdates were accessed. Notice emails reach members that Friday.
October 17, 2026 — Canadian Media Reports
Global News, CTV and CBC report the breach. The company declines to say how many members were affected.
October 2026 — Credit Monitoring Promised
The company says it is working to offer credit monitoring to customers who want it and will post an update once the service is in place.
As of October 22, 2026 — No Lawsuit Reported
No class action, settlement or claim form has been reported. Regulators have been notified, per the company.
Three Things to Watch For
The stolen fields are exactly what makes a fake More Rewards message look real:
“Verify your More Rewards account” messages
The company says it will never ask for your password, verification codes, banking or card details, Social Insurance Number or security-question answers. Its real emails come only from @morerewards.ca and @mail-morerewards.ca.
Calls that know your birthday
A caller who reads back your name, address and date of birth has not proven anything — that is the data that was taken. Hang up and call the number on the company’s own site or the notice, 1-833-690-1146.
“Claim your More Rewards settlement” pages
There is no settlement and no claims portal. A page asking for your SIN or bank details to “secure your share” is collecting data, not filing a claim.
More Rewards Breach — Questions People Actually Ask
Short answers to the questions people ask most about this case.
Is the More Rewards breach email real?
A real notice went out starting October 16, 2026, from More Rewards. Real messages come from @morerewards.ca or @mail-morerewards.ca, and the notice does not ask you to click a link, sign in or provide anything. If in doubt, call customer service at 1-833-690-1146 rather than replying.
Is there a More Rewards data breach lawsuit or class action?
As of October 22, 2026, none has been reported. If a proposed class action is filed, it would most likely be in the Supreme Court of British Columbia, and it would need court certification before it became a class action.
What information was accessed?
Per the company: your name and, if you provided them, your address, phone number, email addresses and date of birth. It says passwords, credit card data and transaction history were not accessed.
Which stores use More Rewards?
Pattison Food Group’s Save-On-Foods, Buy-Low Foods, PriceSmart Foods and Nesters, and Quality Foods on Vancouver Island, per Global News and CTV.
How many people were affected?
The company has not said. CTV, CBC and Global News all asked and got no number.
Do I need to change my password?
The company says a reset is not required because passwords were not accessed. Some members reported errors when they tried to change theirs. Changing it is still harmless, especially if you reuse that password elsewhere.
I live in the U.S. Does this affect me?
Only if you had a More Rewards account at one of these Western Canadian stores. This is a Canadian incident; U.S. courts, U.S. breach laws and U.S. settlements do not cover it. For a cross-border Canadian breach case, see our WestJet data breach page.
What happens after a data breach like this?
The company investigates, notifies the privacy regulators and members, and here has promised credit monitoring. A lawsuit may or may not follow. Meanwhile, the Canadian Centre for Cyber Security warns stolen contact data makes phishing more convincing — treat unexpected messages with suspicion and keep the notice email.
About This Information
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology. Reviewed by Leonard Goldberg, Editor · Last updated - $236 billion in real payouts analyzed · See what we found
This page is for general information only and is not legal advice. Lawsuit status, eligibility, and compensation can change. Settlement Insight is not a law firm and does not represent any party. Consult a licensed attorney about your specific situation.
Related Consumer Brand Lawsuits
Other cases and free tools — not about this case.
Similar cases we track
- WestJet Data Breach LawsuitAnother Canadian breach and how its class actions are moving
- Data Breach Settlement CalculatorWhat comparable breach settlements have paid per person
- Open Class Action SettlementsSettlements currently taking claims, with deadlines
- Settlement Payout CalculatorEstimate a per-person share from a fund and claim rate