Loblaw CEO apologizes to 2 million over data breach

The chief executive of Loblaw Companies Ltd. has apologized to about two million shoppers over a data breach earlier this year, and the company is offering them two years of free credit monitoring.

CEO Per Bank said in an email to affected customers, seen by CBC News, that the company is sorry for the concern the breach may cause. “We know you trust us to protect your information, and we take that responsibility seriously,” he wrote.

Loblaw, based in Brampton, Ont., operates about 2,500 stores across Canada under banners that include Loblaws, No Frills, Real Canadian Superstore, Zehrs and Fortinos. The company announced in March that unauthorized activity had taken place in certain technology systems around Feb. 23. Its internal investigation has since found that an unauthorized third party accessed personal information, CBC reported.

The information included names, addresses, phone numbers, birthdates and purchase details, according to CBC’s account of the email. We reported on Oct. 23 that Loblaw had begun notifying about two million customers.

As a precaution, Loblaw logged customers out of applications that use its PCiD credentials. Those include the PC Optimum loyalty program, the PC Express online grocery service and the PC Financial portal.

The credit monitoring and identity restoration services are provided through TransUnion. Affected shoppers have until Feb. 28, 2027, to enrol. The company also told recipients to be cautious about unexpected emails, calls or texts that ask for personal information or ask them to click a link or download an attachment, and to report suspicious account activity to the appropriate organization.

Privacy experts told CBC the offer has limits. Cat Coode, a Waterloo, Ont., privacy and data strategist, said credit monitoring only helps if someone tries to use the information to apply for credit or certain government documents. “You can change your credit card number, but you can’t change your birthdate,” she said.

Maanit Zemel, a Toronto lawyer who specializes in privacy and cybersecurity law, said organizations in Canada are legally required under federal and provincial privacy law to keep the personal information they collect safe. He described the federal Personal Information Protection and Electronic Documents Act, which came into force in 2001, as “stuck in the 90s.”

The federal government introduced Bill C-36, the Protecting Privacy and Consumer Data Act, in June. It proposes to overhaul the private-sector privacy framework and to treat privacy as a fundamental right. Zemel said that if it passes, penalties for companies that mishandle customer data would be far more serious.

The Loblaw notices follow other recent breaches. Ontario police services have paused tips through Crime Stoppers after a separate data leak, which we covered in our report on the Crime Stoppers pause.

Source: CBC News, Oct. 23 and 24, 2026.

If you find reporting like this useful, consider supporting Canada News Media, an independent Canadian newsroom with no corporate parent.