Loblaw begins notifying two million customers affected by March data breach
The grocer is offering two years of free credit monitoring and says the extent of leaked information varies by customer.
BRAMPTON · Loblaw Cos. Ltd. has started contacting approximately two million Canadians whose personal information was accessed in a data breach last March. The company is now providing specific details to each affected customer about which of their data was compromised. The leaked information may include names, email addresses, home addresses, dates of birth, loyalty card numbers, certain purchase order details and partial payment card information. Loblaw says the extent of the leak differs for each individual and not every type of data was involved for all customers.
The grocer is advising those affected to be cautious of unexpected emails, calls or texts. It is also offering complimentary credit monitoring and identity restoration services through TransUnion. In a statement, Loblaw said it worked closely with cybersecurity specialists to contain the incident and has apologized to customers. The free credit monitoring and identity restoration service is available for two years, with an enrollment deadline of Feb. 28, 2027.
The breach was first detected in March when the company noticed suspicious activity on its IT network. An investigation determined an unauthorized third party had accessed some basic customer information, though Loblaw did not disclose the number of affected individuals at that time. The company said it conducted a detailed investigation, notified law enforcement and regulatory authorities, and strengthened its security systems. As a precautionary measure, it also logged customers out of its PC Optimum loyalty program, PC Express online grocery service and the PC Financial portal. According to a report by CBC, Loblaw is warning customers to be wary of communications asking for personal information or prompting them to click links or download attachments. This incident follows other recent data breaches affecting Canadian consumers. Yadude Books reported in October that the More Rewards loyalty program confirmed a breach that accessed names, addresses, phone numbers, email addresses and dates of birth.
With files from The Canadian Press, The Globe and Mail and BNN Bloomberg