Loblaw CEO apologizes to 2 million shoppers for personal data hack, offers free credit monitoring

Privacy expert says free credit monitoring offered by Loblaw provides limited protection

The CEO of Canada's largest grocery retailer is apologizing to two million shoppers for a data breach earlier this year where hackers accessed private information, including names, addresses, phone numbers, birthdates and purchase details.

Brampton, Ont.-based Loblaw operates 2,500 stores nationwide under its namesake Loblaws banner, as well as numerous sub-brands including No Frills, Real Canadian Superstore, Zehrs and Fortinos.

In March, Loblaw announced that unauthorized activity took place "in certain Loblaw technology systems" around Feb. 23. In an email this week to impacted customers, the company says its internal investigation found an "unauthorized third party" accessed certain personal information.

"We know you trust us to protect your information, and we take that responsibility seriously," Loblaw CEO Per Bank states in the email seen by CBC News. "We're sorry for the concern this may cause, and are committed to supporting you and helping protect your information."

Loblaw stores returning produce country-of-origin labels after backlash

As a precaution, Loblaw says customers were logged out of applications that use the company's PCiD credentials. These include loyalty programs like PC Optimum, the PC Express online grocery service and the PC Financial portal.

The company is offering two years of free credit monitoring and identity restoration services through TransUnion. Impacted shoppers have until Feb. 28, 2027 to enroll.

Save-On-Foods loyalty program members had personal information accessed in cybersecurity breach

Save-On-Foods loyalty program members had personal information accessed in cybersecurity breach

CBC Investigates Crime Stoppers had 'potentially one of the most harmful data breaches' Canada has seen. What's ?

Crime Stoppers had 'potentially one of the most harmful data breaches' Canada has seen. What's ?

Loblaw is also advising those who receive the email to "be cautious" unexpected emails, calls or texts asking for personal information or asking you to click a link or download an attachment.

"Keep an eye on your accounts and report any suspicious activity to the appropriate organization," the CEO says in the email.

Understanding credit monitoring services

Consumers should know that credit monitoring services offer limited protection, warned Cat Coode, a Waterloo, Ont.-based privacy and data strategist.

"It only covers if someone is going to use your information in order to apply for a credit card or apply for certain government documents. It doesn't cover the spectrum of the things that you could do with that data," she told CBC News on Friday.

"The privacy issue can never be resolved … Once your data is available, it is available. ... You can change your credit card number, but you can't change your birthdate."

More than a 'slap on the wrist'?

All organizations in Canada have a legal obligation to keep the personal information they collect safe, says Maanit Zemel, a Toronto-based lawyer who specializes in internet, privacy and cybersecurity law.

"It's a regulatory obligation imposed by both federal and provincial privacy legislation."

Federally, there is the Personal Information Protection and Electronic Documents Act. But Zemel calls PIPEDA, which officially came into force in 2001, "stuck in the 90s."

The government introduced Bill C-36, the Protecting Privacy and Consumer Data Act, in June. It proposes a major overhaul of Canada's private sector privacy framework, updating language to establish privacy as a "fundamental right" and replacing parts of PIPEDA.

New privacy bill would give Canadians right to request companies delete AI deepfakes

New privacy bill would give Canadians right to request companies delete AI deepfakes

The bill also requires companies to conduct a "privacy impact assessment" before transferring personal data outside of Canada.

If passed, Zemel says the new legislation will significantly up the consequences for companies found to have mishandled the personal data of customers.

"It's no longer going to be a slap on the wrist," he said. "There's going to significant consequences for a potential failure to comply with these requirements, including appropriate security safeguards."

Jeff Lagerquist is a senior writer with CBC News based in Toronto. Originally from Erin, Ont., he studied journalism at Toronto Metropolitan University. Jeff previously worked as a senior reporter for Yahoo Finance Canada. He was also a reporter and digital producer for CTV National News, BNN Bloomberg and The Financial Post. In 2025, he was a Columbia University energy journalism fellow.

With files from the CBC's James Dunne and Brock Wilson

Go Public Bank fraud victims want Ottawa to make big banks pay more

Video Crime Stoppers hack exposes personal information of tens of thousands of Canadians

Save-On-Foods loyalty program members had personal information accessed in cybersecurity breach