Loblaw says March breach affected about two million Canadians

Loblaw said on October 23, 2026 that it is starting to notify about two million Canadians affected by a data breach in March 2026, with per-person specifics on what leaked. The company said the breach may have revealed name, email address, home address, date of birth, loyalty card number, certain purchase order details and partial payment card information, with the mix varying by person and not all types involved for every customer. Loblaw is advising customers to watch for unexpected emails, calls or texts, and is offering complimentary credit monitoring and identity restoration services through TransUnion.

The company said in March that it detected suspicious activity on its IT network and determined an unauthorized third party had accessed some basic customer information, but it did not disclose the scale at the time. It said it conducted a detailed investigation, notified law enforcement and regulatory authorities, and strengthened its security systems.

Sources: The Canadian Press, via Barchart; Grocery Business Magazine