Loblaw Notifies Two Million Customers of Data Breach
The retail giant confirms unauthorized access to personal data occurred between February 23 and March 5, 2025.
Updated on Oct. 28, 2026 in Cybersecurity
Live Poll
Do you trust large retail companies to adequately protect your personal data and sensitive information?
Loblaw has officially notified two million Canadians about a data breach that occurred in early 2025. The compromised information includes names, home addresses, phone numbers, email addresses, dates of birth, and order histories.
Why it matters
This incident exposes a vast amount of sensitive personal information for millions of Canadians, necessitating immediate identity protection measures for those impacted. Affected customers face long-term risks regarding data privacy and potential fraud, requiring vigilant monitoring of their personal financial records.
The unauthorized access impacted 2 million individuals and involved exfiltration of sensitive data including dates of birth and personal contact details. Loblaw responded by disconnecting users from its PC Optimum and PCiD applications to mitigate the security event.
The players
Loblaw
Loblaw is a major Canadian retail corporation that operates numerous grocery chains and pharmacy brands across the country.
TransUnion
TransUnion is a global consumer credit reporting agency that provides credit monitoring and identity protection services to businesses and individuals.
The details
The breach resulted from unauthorized access to company systems between February 23 and March 5, 2025, allowing an outside party to harvest significant customer information. In response to the discovery of this intrusion, the retailer took steps to secure its digital infrastructure by temporarily cutting off access to its primary mobile applications.
Timeline
The unauthorized access to customer data began on February 23, 2025.
The unauthorized access to customer data ended on March 5, 2025.
Loblaw notified affected customers regarding the data breach in October 2026.
Customers must enroll in credit monitoring services by February 28, 2027.
The Tech Race
This incident follows the reporting standards established by the Personal Information Protection and Electronic Documents Act, which dictates how Canadian companies must handle significant security lapses. It marks a departure from standard operations as the firm works to update legacy digital protections against modern cyber threats.
Impacted customers are eligible for 24 months of complimentary credit monitoring and identity restoration through TransUnion. Users should check their communication from the company and follow the provided link before the February 2027 deadline to activate these protections.
The takeaway
Customers who have received a notification should act promptly to secure their credit files through the provided identity restoration services. Regularly updating account passwords and monitoring financial statements remains a critical habit for any user of digital retail applications.
What happens next
Affected customers have until February 28, 2027, to finalize their enrollment in the provided credit monitoring and identity restoration services.
Further reading
For more information on digital safety, visit the Cybersecurity section.
Source note: This article includes information reported by Chatelaine.
Live Poll
Do you trust large retail companies to adequately protect your personal data and sensitive information?
