NewsCompaniesFlawsGuides
Get the app
HighUpdated

Loblaw breach exposes personal information of approximately two million Canadians

A Loblaw breach affected approximately two million Canadians, exposing varying combinations of contact, birth date, loyalty, purchase and partial card details. Check your individual notice, verify unexpected messages and use the identity protection offered.

What to do

Read your individual notice to see which information was involved, and take up the free TransUnion credit monitoring and identity protection if offered. Verify unexpected breach messages through Loblaw’s official website or independently obtained contact details before sharing information or following links. Review account statements and report unfamiliar activity directly to the account provider.

What’s happening

Criminals accessed Loblaw systems using compromised credentials, with the earliest access likely on 23 February 2026. Approximately two million Canadians were affected. Loblaw’s 10 March announcement described exposed contact details and said credit card data was unaffected; its October update confirmed a broader exposure, including incomplete payment-card information. Depending on the customer, affected records included names, email and postal addresses, phone numbers, birth dates, loyalty numbers, purchase order details, and billing and shipping addresses. Loblaw says it contained the incident and has observed no further related unauthorised activity. Direct notifications began on 19 October, with free credit monitoring and identity protection offered where appropriate. Completion of all notifications is not confirmed in the sources reviewed as of 3 November. The privacy commissioner’s investigation remains open pending fulfilment of Loblaw’s commitments, including an independent security assessment. Consumer Law Group announced a class action on 2 November. Loblaw has not disclosed whether anyone has been caught.

What
Breach
Affects
Loblaw customer accounts and services, including PC Optimum
Fixed in
Nothing to patch
Since
10 Mar 2026

Timeline

  1. Update

    Consumer Law Group announced that it had filed a national class action against Loblaws Inc. and Loblaw Companies Limited over the breach. Its announcement did not establish liability or compensation.

  2. Update

    The privacy commissioner published Loblaw’s commitments and confirmed that the investigation would remain open until they were fulfilled.

  3. Update

    Loblaw signed commitments to the privacy commissioner, including confirming notification of everyone affected by 16 November 2026 and supplying an independent security assessment by 31 October 2027.

  4. Update

    Loblaw began emailing and posting individual breach notices. Its investigation put the affected population at approximately two million Canadians.

  5. Vendor revised

    Loblaw expanded its disclosure to include addresses, birth dates, loyalty numbers, purchase order details and incomplete payment-card information, varying by customer. It said direct notifications would follow.

  6. Made publicNothing to patch

    Loblaw publicly announced the breach, identifying names, phone numbers and email addresses as exposed. It said its initial investigation indicated passwords, health information and credit card data were unaffected, and required customers to sign in again.

  7. Update

    Loblaw confirmed criminal access to some systems and began containment with outside cybersecurity specialists.

  8. Update

    Loblaw’s investigation later identified this as the likely earliest unauthorised access. Criminals used compromised credentials for a platform used for quality assurance.

Sources

  1. Important information about your accountLoblaw · 2 Oct 2026
  2. Loblaw Notifies Customers of a Low-Level Data BreachLoblaw · 10 Mar 2026
  3. Compliance Letter to the Office of the Privacy Commissioner of Canada by Loblaw Companies LimitedOffice of the Privacy Commissioner of Canada · 26 Oct 2026
  4. Loblaw commits to strengthening security measures following privacy breachOffice of the Privacy Commissioner of Canada · 26 Oct 2026
  5. Loblaw says March data breach affected about two million CanadiansThe Canadian Press via MoneySense · 26 Oct 2026
  6. Loblaw Signs OPC Compliance Letter After 2026 Data BreachRecording Law · 29 Oct 2026
  7. Loblaws Data Breach Canadian Class ActionConsumer Law Group · 2 Nov 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from March 2026 · JSON · RSS