Loblaw is emailing customers about a data security incident from earlier this year, confirming that an unauthorized third party obtained personal information from its systems. The notices follow the forced logout many shoppers saw across Loblaw apps in March, when the company first disclosed unusual activity on its network.
An email sent to customers, which was also received by iPhone in Canada, is titled “Notice Regarding a Data Security Incident.” It opens with a direct apology: “We’re writing to let you know about a data security incident at Loblaw involving some of your personal information. We know you trust us to protect your information, and we take that responsibility seriously. We’re sorry for the concern this may cause and are committed to supporting you and helping protect your information.”
According to that notice, Loblaw became aware of unauthorized activity in certain technology systems on or around March 5, 2026. The company says the earliest instance of unauthorized access was likely on February 23, 2026, and that it acted quickly to contain the incident with help from independent cybersecurity experts. Still, that’s 8 months ago when this hack happened.
The customer notice reviewed for this story lists the following information as involved:
Loblaw’s public advisory says the mix of data varied by customer, and that some people may also have had dates of birth, loyalty account numbers, incomplete payment card information, or billing and shipping addresses involved. The March update on that same page said passwords, health information and credit card data were not compromised, and that PC Financial was not impacted. Stores and payment systems were described as unaffected.
Public reporting puts the number of affected Canadians at about two million. Loblaw says it is notifying people directly by email and mail, after a long validation process to confirm who was impacted and what data applied to each person.
As a precaution, the company logged customers out of Loblaw applications that use PCiD credentials, which include the PC Optimum app and other Loblaw digital services tied to the same login. It says it strengthened technology safeguards, reported the incident to privacy regulators and law enforcement, and has not observed further unauthorized activity tied to this incident.
That forced re-login was the first public sign of trouble for many shoppers in March. The new emails are the detailed follow-up many people have been waiting for since then.
Loblaw is asking people who get a notice to be cautious about unexpected emails, calls or texts that ask for personal information, or that push a link or attachment. It also says customers should watch their accounts and report anything suspicious to the right organization.
Affected customers are being offered 24 months of complimentary credit monitoring and identity restoration through TransUnion’s myTrueIdentity service, with enrolment instructions inside the notice. The deadline to enrol is February 28, 2027. Anyone with questions about the incident can call Loblaw’s dedicated support line listed in the email, 1-833-811-9536.
Canadian retailers have had a rough stretch on this front. Only days ago, More Rewards warned Save-On-Foods and related shoppers after unauthorized access to loyalty data, adding to a year that already included Loblaw’s March disclosure.
Did you get a Loblaw breach notice, and does the list of exposed details match what you expected?
Want to see more of our stories on Google?
P.S. Want to keep this site truly independent? Support us by buying us a beer, treating us to a coffee, or shopping through Amazon here. Links in this post are affiliate links, so we earn a tiny commission at no charge to you. Thanks for supporting independent Canadian media!
