Loblaw Data Breach: 2 Million Canadians Affected, What to Do Now

Loblaw Companies Limited said on October 23, 2026 that the data breach it first disclosed in March now appears to have affected roughly two million Canadians, and the retailer has begun sending individual notifications that tell each affected customer which pieces of their personal information may have been exposed. The company is also offering free credit monitoring and identity restoration services through TransUnion to anyone affected.

What happened: from a "low-level" breach to a two-million-person disclosure

Loblaw first went public with the incident on March 10, 2026, saying it had detected "suspicious activity on a contained, non-critical part of its IT network" and that a criminal third party had accessed "some basic customer information such as names, phone numbers, and email addresses." At the time, Loblaw said passwords, health information and credit card data were not compromised, and that its PC Financial banking arm was not affected. The company logged all customers out of its digital services as a precaution and said the investigation was ongoing.

For more than seven months, that was the extent of what the public knew. Loblaw did not say how many people were involved or what, exactly, "basic customer information" covered beyond names, phone numbers and emails. That changed on October 23, when The Canadian Press reported, via BNN Bloomberg, that Loblaw is now notifying about two million Canadians whose information was exposed in the March incident. It is this scope confirmation, not a new intrusion, that is driving fresh attention to the case.

What data was actually exposed

According to the October 23 disclosure, the information that may have been exposed includes names, email addresses, home addresses, dates of birth, PC Optimum loyalty card numbers, some purchase order details, and partial payment card information. Loblaw and the reporting on its notice are both clear that the exposure was not uniform: the exact mix of data differs from customer to customer, and not everyone affected had every category of information exposed. Loblaw says its direct notifications to individual customers spell out specifically which of their personal data may have been involved, rather than applying a single blanket description to all two million people.

This is a broader list than the one Loblaw gave in March, when it described the exposure only as names, phone numbers and email addresses. The October disclosure adds home addresses, birth dates, loyalty card numbers, purchase order details and partial payment card data to the picture, though Loblaw's original March statement that full credit card numbers, passwords and health information were not compromised has not been contradicted by the later reporting.

Who is affected: PC Optimum, Shoppers Drug Mart and Loblaw's store network

Loblaw is Canada's largest grocery and retail chain, operating banners including Shoppers Drug Mart, No Frills, Real Canadian Superstore and its PC Optimum loyalty program, which spans most of those banners. Because the breach involved a part of Loblaw's IT network tied to basic customer and loyalty information rather than a single banner's point-of-sale system, the roughly two million affected customers can include people who shopped at, or hold loyalty accounts tied to, any of Loblaw's retail brands. Loblaw has said PC Financial, its banking and credit-card business, was not affected by the March intrusion, and nothing in the October update changes that.

If you have ever registered a PC Optimum card, created an online account with a Loblaw-owned banner, or given your contact information to one of its stores or pharmacies, you are a plausible candidate for one of the roughly two million notifications Loblaw is now sending. The company says it is contacting affected customers directly rather than asking the public to self-check, so the clearest sign you were affected is receiving that direct notice from Loblaw.

Breach timeline: March disclosure vs. October scope update

How Loblaw is responding

Loblaw says it has notified law enforcement and relevant regulatory authorities about the breach and has taken steps to strengthen its security systems since the March intrusion. For individual customers, the company's main response is the wave of direct notifications now going out, each one specifying which categories of that person's information may have been involved. Loblaw is also offering free credit monitoring and identity restoration services through TransUnion to affected customers, and is advising everyone to be alert for phishing attempts arriving as unexpected emails, phone calls or text messages that reference their Loblaw or PC Optimum account.

As of this writing, Loblaw's original March 10 breach notice on its own site still describes the incident in its original, narrower terms and does not reflect the two-million-customer figure or the TransUnion offer disclosed on October 23; that figure and the credit-monitoring details come from Loblaw's own statements as reported in the October 23 Canadian Press story carried by BNN Bloomberg.

Why the scope update matters more than the original disclosure

A breach description that says "basic customer information" for an unspecified number of people is hard for any individual to act on. A disclosure that puts a number on it, two million people, and lists specific data categories, including home addresses, dates of birth, loyalty numbers and partial payment card data, changes the calculus. It is the difference between a vague advisory and a concrete reason to watch for identity-theft and phishing risk. That is also why the October 23 update, rather than the March disclosure, is the news here: the underlying intrusion is seven months old, but the scale and the specific data categories involved were not public until this week.

Other large Canadian and international breaches have followed a similar pattern, where an initial, narrow disclosure is later followed by a fuller account of scope once the forensic investigation is complete. Pandromeda has covered comparable scope-and-impact disclosures involving other companies, including the Capcom breach that exposed millions of Capcom ID accounts and the Burger King Japan data breach, both of which also saw affected-customer counts clarified well after the initial incident.

The phishing risk is the practical threat right now

With names, emails, home addresses, birth dates and loyalty numbers in the mix for some customers, the most immediate practical risk from this breach is not fraud on the exposed accounts themselves but phishing and impersonation attempts that use that stolen contact and account information to look legitimate. Loblaw's own guidance to customers centers on exactly this: be wary of unexpected emails, calls or texts, particularly any that reference specific account details to appear credible. A message that already knows your name, email and PC Optimum number can look far more convincing than a generic scam attempt, which is precisely why Loblaw is calling it out directly in its customer guidance.

Security teams covering ransomware and extortion campaigns at other organizations have flagged similar follow-on phishing risk after large-scale data exposures; Pandromeda's recent coverage of the CISA and FBI warning on SafePay ransomware outlines how stolen contact and account data more broadly gets reused in follow-on social-engineering attempts well after an initial breach.

Credit monitoring and identity restoration through TransUnion

Loblaw says the free credit monitoring and identity restoration service it is offering affected customers runs through TransUnion, one of Canada's major credit bureaus, which maintains a dedicated data breach services offering that companies use to provide monitoring and restoration support to customers after an incident like this one. Loblaw's own customer notifications are the enrollment path for the offer; customers who receive a notice from Loblaw should follow the instructions in that notice to sign up rather than searching for a generic TransUnion sign-up page, since breach-response enrollment is typically tied to a code or link specific to the notifying company's program.

What regulators have said

Loblaw says it notified law enforcement and regulatory authorities as part of its investigation into the March intrusion. Pandromeda checked the public announcements of Canada's federal privacy regulator, the Office of the Privacy Commissioner of Canada, and found no published finding or news release specifically naming Loblaw in connection with this data breach as of this writing. Separately, the Commissioner's office has published findings this year on an unrelated PC Optimum matter concerning how long Loblaw retained and anonymized data after account-deletion requests; that finding is not about this breach and should not be confused with it. Pandromeda will update this article if a regulator publishes a breach-specific finding.

What's next

Loblaw's direct notifications to the roughly two million affected customers are still going out, and the company has not published a public breakdown of how many of those two million had each category of data exposed. Watch for: Loblaw updating its own March 10 notice to reflect the new figures and the TransUnion offer; any statement from the Office of the Privacy Commissioner of Canada specifically addressing this breach; and reports of phishing campaigns that reference Loblaw, Shoppers Drug Mart or PC Optimum account details, which would be the clearest sign the exposed data is being actively exploited. Pandromeda will update this article as Loblaw, TransUnion or Canadian regulators release further information.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage