Loblaw breach affected about two million Canadians; privacy commissioner secures security commitments

Updated October 27, 2026. We first covered this breach in March, when Loblaw said it involved basic contact details. This page now reflects the scope Loblaw and the privacy commissioner have since confirmed.

Loblaw Companies Ltd. has begun notifying about two million Canadians that their personal information was accessed in a breach first detected in March 2026. On October 26, 2026, the Privacy Commissioner of Canada announced Loblaw had signed a compliance letter committing to stronger security and an independent review. If you were notified, watch closely for phishing that uses your details.

What happened

According to the Office of the Privacy Commissioner of Canada (OPC), a threat actor used compromised credentials for a platform Loblaw used for quality assurance (QA, the testing of software before release). The earliest likely access was February 23, 2026. Loblaw confirmed the unauthorized access on March 5, 2026, and issued a public advisory and notified the OPC on March 10, 2026.

The OPC’s news release says Loblaw contained the breach in March with help from a third-party cybersecurity firm, posted a notice on its website, and sent an in-app message to users of its PC Optimum app. On October 23, 2026, CP24 reported that Loblaw was starting to notify about two million affected customers directly. The compliance letter says direct notifications by email and mail began on October 19, 2026.

Loblaw signed the voluntary compliance letter on October 21, 2026. The letter states it is not an admission of liability or a finding that Loblaw broke the Personal Information Protection and Electronic Documents Act (PIPEDA, Canada’s federal private-sector privacy law). The investigation stays open until the commissioner is satisfied the commitments are met.

It has not been made public who the attacker was or whether the data has been misused.

Who is affected

About two million Canadians, according to both Loblaw and the OPC. The information involved varies by person and can include name, email address, postal address, phone number, date of birth, loyalty account number, purchase order details, partial payment card information (such as the last four digits) and billing and shipping addresses. The OPC says about 300 people had other information affected and will receive tailored letters.

Full payment card numbers are not listed among the exposed data.

What to do now

If you’re affected

1. Read the notice from Loblaw carefully, and confirm it is genuine by going to Loblaw’s website yourself rather than clicking a link.
2. Be wary of unexpected emails, calls or texts, as Loblaw advises. Messages that quote your address, birthday or recent orders can look convincing.
3. Consider enrolling in the complimentary TransUnion credit monitoring and identity restoration service Loblaw is offering.
4. If you reused your Loblaw password anywhere else, change it there and turn on multi-factor authentication (MFA, a second step such as a code on your phone).

If you run an organization

1. List every system that holds customer data, including test, staging and QA platforms. Attackers look for the forgotten ones.
2. Require multi-factor authentication on every login that can reach personal information, including vendor and contractor accounts.
3. Review who has access to what, and remove accounts that are no longer needed. Good identity and access management makes stolen credentials far less useful.
4. Make sure you have a written breach response plan and know who decides whether a breach must be reported.

What this means for organizations in BC and Alberta

Under PIPEDA, an organization must report a breach to the OPC when it is reasonable to believe the breach poses a “real risk of significant harm” (RROSH), and it must keep a record of every breach for at least 24 months, whether or not it was reportable. In this case, the OPC says Loblaw determined the RROSH threshold was met.

Alberta’s Personal Information Protection Act (PIPA) has a similar test: private-sector organizations must report qualifying breaches to Alberta’s privacy commissioner. BC’s PIPA does not currently require private-sector organizations to report breaches to the BC commissioner, though the commissioner encourages voluntary reporting and notifying affected people where there is a risk of significant harm. Organizations working across provinces, or handling data under federal law, may face more than one set of rules. Our compliance and risk team can help you map which apply, whether you are in British Columbia or elsewhere in Western Canada.

The commitments here are also a useful guide to what the OPC expects after a breach: confirm everyone affected has been notified, document how affected people and risk were identified, and have an independent firm test the fixes.

How happier IT helps

We help organizations find the logins and systems that are easy to miss, put MFA and access reviews in place, and keep watch for suspicious sign-ins through our managed security services. If you’d like a calm look at where you stand, start with a free IT assessment.

Sources

• Loblaw commits to strengthening security measures following privacy breach, Office of the Privacy Commissioner of Canada, October 26, 2026
• Compliance letter: Loblaw Companies Limited, Office of the Privacy Commissioner of Canada, signed October 21, 2026
• Loblaw says March data breach affected about two million Canadians, CP24, October 23, 2026
• Navigating the legislative landscape on data breaches (2026 Data Breach Insights, part 3), McCarthy Tétrault, 2026
• Reporting and recording breaches of security safeguards, McMillan LLP