Loblaw Data Breach: What Was Exposed, Free Credit Monitoring

In short: Loblaw confirmed on October 23, 2026 that a data breach first disclosed in March affected about two million Canadians, exposing details like names, emails, phone numbers, dates of birth and loyalty account numbers depending on the customer. Loblaw is offering two years of free credit monitoring and identity theft protection through TransUnion, with enrollment open until February 28, 2027.

Loblaw, Canada's largest food and pharmacy retailer, spent seven months reviewing a breach it first flagged in March before telling customers how many people were affected and what, specifically, leaked. If you shop at Loblaw-owned stores or use PC Optimum, PC Express or PC Financial, here's what to know and what to do before the deadline passes.

What data did Loblaw say was exposed in the breach?

The exposed information varies by customer, but Loblaw's updated notice says the exposed data could include "name, address, phone number, email address, dates of birth, loyalty account number, certain purchase order details, incomplete payment card information, and billing and shipping addresses," according to Loblaw's updated notice. The company says customers who received a direct notice by email or letter should check it for the exact types of information involved in their case.

How many people were affected, and when did this happen?

About two million Canadians, Loblaw said in an announcement reported by CTV News on October 23, 2026. The unauthorized activity began around February 23, 2026, according to Loblaw's internal investigation, and the company first disclosed the breach publicly on March 10, 2026, when it said a criminal third party had accessed "basic customer information such as names, phone numbers, and email addresses."

CEO Per Bank apologized directly to affected customers by email, writing "we take that responsibility seriously" and "we're sorry for the concern this may cause," according to CBC News reporting republished by Yahoo News Canada.

What information was NOT compromised?

Loblaw says its investigation found that passwords, health information and credit card data were not compromised, and that PC Financial itself was not impacted by the breach, according to Loblaw's March notice. Any payment card information involved was incomplete, per the company's later update. As a precaution, Loblaw logged all customers out of accounts using its PCiD credentials, including PC Optimum, PC Express and PC Financial, forcing a fresh login.

How do I enroll in the free credit monitoring?

Loblaw is offering two years of free credit monitoring and identity restoration services through TransUnion, and affected customers have until February 28, 2027 to sign up, per CBC's reporting. To enroll:

1. Find the official email or letter Loblaw sent you directly — it lists exactly what information of yours was involved and how to access the protection services, per Loblaw's notice.
2. Use the enrollment link or instructions in that notice, not a link forwarded or texted to you from an unknown sender.
3. If you're unsure whether a message is genuine, go to Loblaw's own breach page directly instead of clicking through.
4. Complete enrollment with TransUnion, Loblaw's partner on this offer, before February 28, 2027.
5. Keep a copy of your enrollment confirmation in case you need to reference it later.
6. Review our full data breach response checklist for additional steps beyond the free monitoring offer.

What should I watch out for after this breach?

Expect phishing attempts that use the exposed details to look convincing — fake messages posing as Loblaw, PC Optimum or TransUnion. Loblaw's own advice: "Call the company or agency in question directly, if you receive a text message or email. Make sure you research their contact information and don't use the information provided in the first message," per Loblaw's updated notice. Loblaw also recommends you "regularly review your account statements and monitor for any unfamiliar or unauthorized activity," and contact your account provider directly if something looks off.

Credit monitoring has limits, though. Privacy and data strategist Cat Coode told CBC News it "only covers if someone is going to use your information in order to apply for a credit card or apply for certain government documents," and doesn't address the full range of harms from exposed data — and some details, like a birthdate, can't be changed once leaked, per CBC's report. Since your name, email, phone number and birthdate are now out, it's worth checking whether that information is already circulating on people search sites and taking steps to remove it.

What are my rights as a Canadian affected by this?

Under Canada's federal privacy law, companies must report breaches posing a real risk of significant harm to the Privacy Commissioner and notify affected individuals, including a description of what happened, what information was involved, and steps you can take to reduce the risk, according to the Office of the Privacy Commissioner of Canada. Significant harm under that law includes identity theft, financial loss and negative effects on your credit record. It is an offence for an organization to knowingly fail to meet these reporting and notification duties, which can lead to fines. You can also request your data from companies to see exactly what they hold on you going forward.

What's still unknown?

Loblaw has not publicly identified who carried out the breach or explained why it took about seven months to go from the March disclosure to the October announcement of the two-million customer count. The company says it "worked closely with third-party cybersecurity experts to promptly contain the incident" and that "no further unauthorized activity related to this incident has been observed," according to Loblaw's updated notice, but it has not said whether a perpetrator has been identified or caught.