Loblaw CEO Apologizes to 2 Million Shoppers After March Data Breach — Here's What Was Exposed

Photo: Geo Swan, Wikimedia Commons, Public domain (file photo).

Back in March, millions of Canadians got mysteriously booted out of their PC Optimum app and had to log back in. Loblaw called it a security measure. Seven months later, the company has said the quiet part out loud: a criminal third party got into its systems, walked off with personal details, and about two million shoppers are affected. On Friday, Loblaw's chief executive apologized — and offered free credit monitoring to make amends.

This is one of the biggest Canadian retail breaches in recent memory. And the details got worse between March and October.

What happened in March

On March 10, Loblaw disclosed "unusual activity" on what it called a contained, non-critical part of its IT network. The initial line: an unauthorized third party accessed "basic customer details" — names, phone numbers, email addresses. Customers were force-logged-out of PC Optimum and every other Loblaw app that uses the company's PCid credentials as the company refreshed all active sessions.

Loblaw stressed what wasn't taken: passwords, health information, and full credit card data were not compromised, PC Financial was not affected, and stores, payment systems, and operations were untouched. It sounded — at the time — like a contained scare.

What the October update revealed

Then came the October 2 update, and the list of exposed data categories got meaningfully longer. Loblaw now says the information that may have been involved includes names, addresses, phone numbers, email addresses, dates of birth, loyalty account numbers, certain purchase order details, incomplete payment card information, and billing and shipping addresses. Not every type applied to every customer — the mix varied — but that's a materially bigger exposure than "basic details."

The company says it will begin notifying impacted customers directly in the coming weeks through its trusted partner Cyberscout, a division of TransUnion — and if you get one of those notices, it will spell out exactly which of your details were involved and how to claim the protection offer. Around two million people are in scope, per CBC and Canadian Press reporting this week.

The apology — and what you actually get

CBC reported Friday that Loblaw's CEO is personally apologizing to the roughly two million affected shoppers. The make-good: 24 months of complimentary credit monitoring and identity restoration through TransUnion's myTrueIdentity service, with enrollment open until February 28. Loblaw says the incident is resolved — cybersecurity specialists contained it, no further unauthorized activity has been observed, and the matter has been reported to law enforcement and regulators, who declined to comment on an ongoing investigation.

A word of caution for the notification window, because this is exactly when scammers strike: fraudsters love impersonating breach notifications. Loblaw's own guidance says its real notices explain what was exposed and point you to the official page — they do not ask you to click a link to confirm your identity or hand over passwords, credit card numbers, or a Social Insurance Number. Treat any surprise text or email asking for those as hostile. If you suspect fraud, report it to local police and the Canadian Anti-Fraud Centre at 1-888-495-8501.

The uncomfortable question is why the full scope took seven months to surface. Loblaw says it spent that time running a detailed review with third-party specialists and notifying regulators. That's the standard playbook — but for two million shoppers who shop at Loblaws, No Frills, Shoppers Drug Mart, and Real Canadian Superstore, it means months of not knowing what was actually taken. An apology and two years of TransUnion monitoring is the industry-standard fix. Whether it's enough, those two million people get to decide.

Editor's note: No video from a reputable outlet covering Loblaw's apology was available at publication time, so none is embedded — the official Loblaw notice and the CBC and Canadian Press reports below carry the confirmed details instead.

Sources

• CBC News — "Loblaw CEO apologizes to 2 million shoppers for personal data hack, offers free credit monitoring" (Oct. 23, 2026) — Full story
• Loblaw Companies Limited — "Real Talk: Important Information About Your Account" (official incident notice, updated Oct. 2, 2026) — Full notice
• Tech Insider — "Loblaw Data Breach: 24 Months Free Monitoring [2026]" (Oct. 23, 2026) — Full story
• Cybersecurity Canada — "Loblaw Data Breach Update: How to Protect Your Business from Fake Notification Scams" (Oct. 2026) — Full story