Loblaw Says Its March Breach Hit 2 Million Shoppers
Loblaw's CEO has apologized to about two million customers whose names, addresses, birthdates and purchase details were taken in a February breach, and is offering two years of TransUnion monitoring.
Loblaw, Canada’s largest grocery retailer, has told about two million shoppers that their personal information was taken in a breach first disclosed back in March, CBC News reports. In an email to affected customers this week, CEO Per Bank apologized and offered two years of free credit monitoring. According to CBC, the exposed details include names, addresses, phone numbers, birthdates and purchase details.
The timeline is long. Loblaw said in March that unauthorized activity took place in some of its technology systems around Feb. 23, and at the time it didn’t say how many customers were involved. Its internal investigation has now concluded that an “unauthorized third party” accessed certain personal information. The company still hasn’t said publicly how the attacker got in, and no group has claimed the attack in the CBC report. The Globe and Mail separately reports the data may also include email addresses, loyalty card numbers and partial payment card details, and that what was exposed varies from person to person.
Back in March, Loblaw logged customers out of everything that uses its PCiD login as a precaution. That covers PC Optimum, PC Express and the PC Financial portal. Loblaw runs about 2,500 stores, including Loblaws, No Frills, Real Canadian Superstore, Zehrs and Fortinos, so the customer base is enormous.
What it means for you
If you shop at a Loblaw-owned store or use PC Optimum, check your inbox for the notice. The credit monitoring comes through TransUnion and includes identity restoration, and you have until Feb. 28, 2027 to sign up. A privacy expert quoted by CBC points out that monitoring only catches someone using your details to apply for credit or certain documents. It does nothing about the bigger issue: your birthdate and address are now out there for good, and they make scam calls and emails far more convincing.
Do this now
- If you got the email, enroll in the free TransUnion monitoring before Feb. 28, 2027. Go to the enrollment page by typing the address from the official notice, not by clicking a link in a forwarded message.
- Expect phishing that mentions Loblaw, PC Optimum or your recent purchases. Loblaw won’t call or text asking for passwords or payment details.
- Use a unique password for your PCiD account and turn on any extra sign-in protection offered.
- Consider a credit freeze with Equifax and TransUnion Canada if you don’t plan to apply for credit soon.