Loblaw logs out all customers after hackers access contact details
Loblaw Companies Ltd. told customers on March 10 that a criminal third party had accessed some basic customer information in a part of its IT network, and signed every customer out of its digital services as a precaution.
Loblaw is Canada's largest food and pharmacy retailer, and its PC Optimum loyalty program and PCid login are used by millions of shoppers. Even limited contact data from a customer base that large is valuable to scammers, who can use it to send messages that look like they come from the company.
What happened
Loblaw said it identified suspicious activity in a "contained, non-critical part of its IT network" and found that the intruder accessed names, phone numbers and email addresses, BleepingComputer reported. The company said its investigation found no evidence that passwords, health information or credit card details were compromised, and that PC Financial was not affected.
"Out of an abundance of caution," the company logged all customers out of their accounts, meaning shoppers had to sign in again to use the PC Optimum app and other services that rely on PCid, MobileSyrup reported.
What we don't know yet
Loblaw has not said how many customers were affected, who was responsible or how the attacker got in. At the time of the first reports, no group had claimed the attack and no Loblaw data had appeared for sale on criminal forums.
What to do
- Expect fake "Loblaw" or "PC Optimum" notifications that use the breach as a hook. Do not click links in unexpected messages about your points or account.
- Sign back in only through the official app or website, and use a unique password for your PCid.
- Turn on any additional sign-in protection the company offers.
- Report scam messages to the Canadian Anti-Fraud Centre.
