TL;DR: Loblaw said on October 23, 2026 that it is starting to notify about two million Canadians affected by a breach it detected in March. Depending on the person, exposed data may include names, email and home addresses, dates of birth, loyalty card numbers, some order details and partial payment card information. Loblaw is offering free TransUnion credit monitoring and identity restoration. The bigger risk now is scam emails and texts dressed up as breach notices.
What happened
According to the Canadian Press report carried by CP24, Loblaw detected “suspicious activity” on its IT network in March 2026 and found that an unauthorized third party had accessed some basic customer information. It investigated, notified police and regulators, and says it strengthened its security.
Seven months later, on October 23, it began notifying about two million Canadians. The company hasn’t said how the attackers got in.
What may have been exposed
Not everyone had everything exposed. The possible data includes:
- names;
- email and home addresses;
- dates of birth;
- loyalty card numbers;
- some purchase order details;
- partial payment card information.
Partial card data can’t be used to shop on its own, but it is gold for phishing: “We noticed a charge on your card ending 4417” sounds terrifyingly real when the last four digits are correct.
The scam wave to expect
Every big Canadian breach is followed by fake notices. Watch for:
- emails or texts saying “Your Loblaw/PC account was compromised, verify here”;
- fake “compensation” or “gift card for the inconvenience” offers;
- calls from a “bank fraud team” that quote your partial card number and ask you to move money or read out a code;
- loyalty-points theft attempts, where scammers log in and redeem your points.
Small businesses are being targeted with fake breach notices too, as Cybersecurity Canada notes.
What to do now
- Wait for the real notice, then enroll in the free TransUnion credit monitoring using the code in it. Don’t click enrollment links in unexpected texts.
- Change your loyalty account password and any other account that shared it. A leaked password is the most common way points get stolen.
- Place a fraud alert with Equifax and TransUnion Canada, or go further with a credit freeze in Canada.
- Check your card statements for small test charges.
- Report scam messages to the Canadian Anti-Fraud Centre and see our guide to reporting to the CAFC.
A breach rarely comes alone
If your email is on one breached list, it is usually on several. A free email exposure check shows where it has turned up, which helps you guess what a scammer knows before they call.
Frequently Asked Questions
How many people were affected by the Loblaw breach?
Loblaw says it is notifying about two million Canadians.
When did the Loblaw breach happen?
Loblaw detected suspicious activity in March 2026 and began notifying customers on October 23, 2026.
Was my full credit card number stolen?
Loblaw says partial payment card information may have been exposed, not full card numbers.
Is Loblaw offering credit monitoring?
Yes. Affected customers are offered complimentary credit monitoring and identity restoration through TransUnion.
Sources
- CP24 / Canadian Press: Loblaw says March data breach affected about two million Canadians (Oct 23, 2026)
- The Globe and Mail: Loblaw says March data breach affected about 2 million customers
- Cybersecurity Canada: Loblaw breach and fake notification scams
- Canadian Anti-Fraud Centre