The Loblaw data breach affected approximately two million Canadians, according to the Office of the Privacy Commissioner of Canada, which says the grocery retailer has agreed to strengthen its security safeguards following the incident.
The breach occurred in February 2026 after a hacking group gained access to Loblaw systems and customer account information.
The company contained the incident in March with help from a third-party cybersecurity firm and has since carried out a more detailed review of the affected information.
Table of Contents
Loblaw Data Breach: What Loblaw says was exposed
Loblaw’s updated incident notice says the information varied from customer to customer and that not every affected person had the same data involved.
The categories identified by the company include names, addresses, phone numbers, email addresses, dates of birth, loyalty account numbers, certain purchase-order details, billing and shipping addresses and incomplete payment-card information.
Loblaw previously said passwords, health information and full credit-card data were not compromised.
It also said PC Financial was not affected by the incident.
The company’s notice says stores, payment systems and normal operations were unaffected.
Loblaw also says it has observed no further unauthorized activity connected to the incident.
Customers are being contacted directly
Loblaw began notifying affected individuals directly after completing its review of the incident.
Notifications are being sent where appropriate and where the company has the ability to identify and contact the person involved.
The retailer says some customers may be contacted through Cyberscout, a division of TransUnion, which Loblaw has authorized to support its response.
Individual notices are expected to identify the categories of information linked to each customer and explain what assistance is available.
Relevant individuals may receive complimentary credit-monitoring and identity-theft protection services.
Customers who receive a notification should use the contact information provided in that notice, while independently checking that messages and websites are legitimate before submitting personal information.
Privacy commissioner keeps investigation open
The federal privacy commissioner’s office opened an investigation into the incident and remained engaged with Loblaw as the company responded to the breach.
In a compliance letter signed by Loblaw on October 21, 2026, the company committed to further measures designed to meet its obligations under Canada’s federal private-sector privacy law and reduce the risk of another incident.
One of those commitments is to hire an external security firm to assess whether Loblaw’s enhanced safeguards are effective.
The company must also tell the privacy commissioner how it will address any additional recommendations from that review.
The commissioner’s investigation remains open until the office is satisfied that Loblaw has completed its commitments.
That means the October update is not the final regulatory step in the matter.
What affected customers should do
Customers who receive a letter or email from Loblaw should review the notice carefully to determine which information may have been involved in their case.
- Use the credit-monitoring and identity-protection services offered through the official notification.
- Watch bank, credit-card and loyalty-program accounts for unfamiliar activity.
- Be cautious with unexpected emails, texts or phone calls referring to the breach.
- Do not click links or open attachments in suspicious messages.
- Contact Loblaw through its official website or published customer-service number if a message appears questionable.
- Report suspected fraud to local police and the Canadian Anti-Fraud Centre.
Because the exposed information can include contact details, birth dates and loyalty-account information, affected customers should also be alert to targeted phishing attempts.
A message that appears to know a person’s shopping history or basic identity details may still be fraudulent.
Loblaw recommends using unique passwords, enabling multi-factor authentication and contacting financial institutions directly through independently verified phone numbers or websites.
What happens next
Loblaw’s next major obligation is to complete the external security assessment and respond to any further recommendations.
The Privacy Commissioner of Canada will continue monitoring whether the company follows through on the commitments in its compliance letter.
For customers, the immediate priority is to respond only to verified communications, use any protection services offered and monitor accounts for signs of misuse.
The full impact may differ between individuals, which is why the direct notification will be more useful than a general company-wide description of the incident.
Frequently Asked Questions
How many Canadians were affected by the Loblaw data breach?
The Office of the Privacy Commissioner of Canada says the cyberattack affected approximately two million Canadians.
What information may have been exposed?
Depending on the customer, the information may include names, addresses, phone numbers, email addresses, dates of birth, loyalty-account numbers, purchase details, billing and shipping addresses and incomplete payment-card information.
Were Loblaw passwords or full credit-card numbers compromised?
Loblaw says passwords, health information and full credit-card data were not compromised. It identified incomplete payment-card information as one category that may have been involved for some customers.
How will affected Loblaw customers be contacted?
Loblaw says it is notifying impacted individuals directly and may use Cyberscout, a TransUnion division, to send communications and provide access to credit monitoring and identity-theft protection.
What should customers do if they receive a breach notice?
Verify that the communication is genuine, use the protection services offered, monitor accounts, avoid suspicious links and report suspected fraud to police and the Canadian Anti-Fraud Centre.
Fact-Checked: Key facts were checked against the Office of the Privacy Commissioner of Canada and Loblaw’s official incident update.
Disclaimer: Customers should rely on direct, verified communications from Loblaw and their financial institutions for account-specific instructions.