loblaw breach
What you need to do
- Treat any unexpected email, text or call that mentions Loblaw, PC Optimum or the breach as suspicious.
- If you get a notice, enrol through the instructions in the letter itself, not through links in other messages.
- Businesses should warn staff and customers that breach-themed phishing usually follows notices like these.
Loblaw is emailing and mailing customers affected by a data security incident that began in February 2026. The notices confirm that an unauthorized third party obtained personal information from the company's systems. Public reporting puts the number of affected Canadians at about two million.
What was taken
The customer notice includes name, email address, mailing address, phone number and purchase order details. Loblaw's public advisory says the data varies by person. Some customers may also have had their date of birth, loyalty account number, partial payment card information and billing and shipping addresses exposed.
Loblaw has said passwords, health information and full credit card data were not compromised. PC Financial was not affected, and stores and payment systems kept running normally.
Timeline
- Feb. 23, 2026: Earliest likely unauthorized access.
- On or around March 5, 2026: Loblaw becomes aware of unusual activity and logs users out of apps that use PCiD credentials, including PC Optimum.
- Late October 2026: Notices go out after a validation process to confirm who was affected and which data applies to each person.
Loblaw says it contained the incident with outside cybersecurity experts and has not seen further unauthorized activity.
Support for affected customers
Affected customers are offered 24 months of free credit monitoring and identity restoration through TransUnion's myTrueIdentity service. The enrolment deadline is Feb. 28, 2027. Loblaw has set up a support line at 1-833-811-9536.
The bigger short-term risk is not the original breach but what follows it. Names, emails, phone numbers and purchase details are exactly what scammers need to write convincing messages. Expect fake "refund," "PC Optimum points" and "verify your account" messages over the coming weeks.
