Loblaw starts notifying two million customers of March breach

BNN Bloomberg carried a Canadian Press report that Loblaw, which calls itself Canada’s food and pharmacy leader, said on October 23 it is starting to notify about two million Canadians affected by its March data breach.

Its own release of March 10, datelined Brampton, Ontario, said a criminal third party accessed some basic customer information such as names, phone numbers and email addresses. Loblaw said then that passwords, health information and credit card data were not compromised. BNN Bloomberg reported that Loblaw did not say in March how many customers were affected.

The list is now longer. BNN Bloomberg reported that the information that may have leaked includes names, email and home addresses, dates of birth, loyalty card numbers, some purchase order details and partial payment card information. Loblaw says the extent differs by customer, and not every type of information was involved for every customer.

BNN Bloomberg reported that Loblaw is offering affected customers free credit monitoring and identity restoration services through TransUnion.

For context, in its 2025-2026 reporting year the federal privacy commissioner’s office received almost 700 breach reports from businesses, affecting more than 20 million Canadians. Federal government institutions filed about 450 reports, affecting more than 48,000 Canadians.

PIPEDA, the Personal Information Protection and Electronic Documents Act, is Canada’s federal law on how private-sector organizations handle personal information. According to the office, complaints under PIPEDA reached 3,044 in 2025-2026, up 109% from the year before. The office said the doubling is likely due to several factors, including greater awareness and easier access to its complaint process.

Sources: BNN Bloomberg · Loblaw Companies Limited · Office of the Privacy Commissioner of Canada