Loblaw Forces Customer Logout Following New Network Data Breach

Loblaw has notified customers that it is currently investigating a cyberattack on its IT network. The company confirmed that a “criminal third-party” gained access to a portion of its system and made off with basic customer information, including names, phone numbers, and email addresses.

As a result of the breach, Loblaw has triggered a security protocol that automatically logged every customer out of their digital accounts. To regain access to PC Optimum or other Loblaw digital services, users are now required to log back in. While the company is labelling the incident as suspicious activity on a “non-critical” part of its network, any unauthorized access to personal data remains a pretty big security failure for the country’s largest grocer.

Loblaw claims its current investigation suggests that highly sensitive data, such as passwords, health information, and credit card numbers, was not compromised. The company also noted that PC Financial accounts do not appear to be impacted by this specific hack.

However, the leak of names and contact information often serves as the first step for scammers to launch more sophisticated phishing attacks against customers.

A History of Security Lapses at Loblaw

This is far from the first time Loblaw has struggled to keep customer data under lock and key. The company has a documented history of security incidents that have left shoppers frustrated:

• PC Optimum Point Theft: For years, the PC Optimum program has been plagued by “points poaching,” where hackers gain access to individual accounts to spend thousands of dollars worth of rewards at the till.
• LifeLabs Breach: Through its ownership of Shoppers Drug Mart and various health ventures, Loblaw was indirectly linked to the massive 2019 LifeLabs breach, which saw the personal data of millions of Canadians exposed.
• PC Plus Points: Back in 2017 Loblaws’ PC Plus saw points stolen from members and full password resets also took place.

More recently, the Privacy Commissioner of Canada concluded PC Optimum account data was never immediately deleted once a customer closed their accounts, with data being held onto for too long by Loblaw.

While Loblaw attempts to downplay this latest event as a “low-level” breach of “basic” info, the reality for Canadians is a growing pattern of digital vulnerability at the supermarket (what’s considered high level besides your name, phone number and email address being leaked?). If you use the same password for your PC Optimum account as you do for your email or banking, now is the time to change it.