Loblaw notifies customers of data breach — Here's what Ontario shoppers need to know

Loblaw is alerting customers to a data breach — that may have compromised their information — by sending notifications to affected customers and offering free credit monitoring and identity theft protection.

Multiple customers took to social media this week to the breach notification from the Canadian grocery giant.

In an email to Metroland Media, a Loblaw spokesperson said the breach was first reported through a notice issued back in March.

Loblaw operates more than 2,400 stores and brands including Loblaws, No Frills, Real Canadian Superstore, Shoppers Drug Mart, and President’s Choice among others.

“Following a thorough investigation to understand the full scope of the incident, we’ve begun notifying affected customers and offering complimentary credit monitoring and identity theft protection services,” the company said.

What Loblaw customer data was exposed in the breach?

In a new notice issued Oct. 22, Loblaw released more details following its review and investigation.

“We know you trust us to protect your information, and we take that responsibility seriously,” Loblaw president and CEO Per Bank said in an emailed notice sent to customers and viewed by Metroland Media. “We’re sorry for the concern this may cause and are committed to supporting you and helping protect your information.”

According to reporting by CBC , Loblaw’s CEO is “apologizing to two million shoppers for a data breach.”

The company said the information compromised varied by customer and not all types of information were exposed for every customer.

Information compromised includes the following:

Address and phone number

Loyalty account number

Certain purchase order details

Incomplete payment card information

Loblaw breach first disclosed in March 2026

According to the notice to customers, Loblaw previously disclosed, on or around March 5, 2026, that it became aware of “unauthorized activity in certain Loblaw technology systems.”

The CEO says Loblaw “acted immediately to contain the incident and brought in independent cybersecurity experts to work with us and to further strengthen our technology safeguards.”

“Based on our investigation, the earliest instance of unauthorized access was likely on Feb. 23, 2026,” Bank said. “Our investigation also determined that certain personal information was obtained by the unauthorized third party.”

In a notice issued on March 10 , Loblaw explained why customers using the PC Optimum app and other Loblaw apps that use PCiD experienced a forced logout.

According to the company website, there are more than 18 million PC Optimum members.

The company, however, did not state how many customers may have been impacted.

Loblaw tells customers to be cautious unexpected emails, calls or texts asking for personal information or asking you to click a link or download an attachment.

You should also keep an eye on your accounts and report any suspicious activity to the appropriate organization.

Loblaw is offering affected customers 24 months of complimentary credit monitoring and identity restoration services through TransUnion’s myTrueIdentity service. You need to enrol by Feb. 28, 2027.