Important information about your account
UPDATE ON INCIDENT ANNOUNCED IN MARCH
Published Date: October 2, 2026
In March, we advised of an incident that impacted some of our customers’ information.
We worked closely with cybersecurity specialists to promptly contain the incident, and since then we have conducted a detailed investigation and further strengthened our technology safeguards. We also notified relevant law enforcement and regulatory authorities and have been working closely with them.
As part of our investigation, we conducted a detailed review to identify the customers and nature of personal information impacted by the incident. While the information varied by customer and not all the types of information were involved for every customer, information included name, address, phone number, email address, dates of birth, loyalty account number, certain purchase order details and incomplete payment card information.
In the coming weeks we will begin notifying impacted customers directly. These notifications will provide additional details about the incident, the steps we have taken to help protect impacted customers and the nature of information relating to the customer. In the interim, we encourage customers to continue practicing caution in relation to unexpected emails, calls or texts asking for personal information or asking you to click a link or download an attachment.
We take this matter seriously and remain committed to protecting our customers’ information.
***********
Published Date: March 10, 2026
As part of our commitment to keeping your information safe, we want to let you know why you experienced a forced logout from your PC OptimumTM app and other Loblaw apps that use PCidTM.
We identified some unusual activity on a limited part of our system. Through our ongoing investigation, we determined that an unauthorized third-party accessed some basic customer details, including names, phone numbers, and email addresses. Loblaw’s current investigation indicates that passwords, health information and credit card data were not compromised. The investigation also indicates that PC Financial was not impacted by this breach.
We took immediate action to further secure our systems. As an added security measure, we refreshed all active sessions, requiring customers to log back in.
By logging back in, you have successfully re-authenticated your account. Your account is secure, and we apologize for any inconvenience this temporary interruption may have caused.
Importantly: stores, payment systems, and operations are all unaffected by this incident.
The Company will provide further updates as necessary as the investigation progresses.
Frequently Asked Questions:
What happened?
On or around March 5, 2026, Loblaw became aware of unauthorized activity within certain parts of its information technology systems.
Loblaw immediately activated its incident response protocols and engaged third-party cybersecurity specialists to assist with containing the incident, investigating its scope, and supporting remediation efforts. As part of this investigation, Loblaw conducted a detailed review to identify the customers and nature of personal information impacted by the incident.
What is Loblaw doing?
We worked closely with third-party cybersecurity specialists to promptly contain the incident, and have since conducted a detailed investigation, further strengthening our technology safeguards. We take this situation very seriously. Privacy and information security are top priorities, and strict measures are in place to protect the information in our care.
We are offering credit monitoring and identity theft protection services to relevant individuals where appropriate.
What information about customers was impacted?
As part of our investigation, we conducted a detailed review to identify the customers and nature of personal information impacted by the incident. While the information varied by customer and not all the types of information were involved for every customer, information included name, address, phone number, email address, dates of birth, loyalty account number, certain purchase order details, incomplete payment card information, and billing and shipping addresses.
If you received an email or letter notice about this incident directly from Loblaw, that notice sets out the types of personal information about you that may have been involved in this incident and provides information on how to access complementary credit monitoring and identity theft protection services.
Am I affected?
Our investigation confirmed that certain data containing personal information was illegally obtained. In accordance with regulatory requirements, we are notifying impacted individuals directly with details about the personal information involved and the support available to them.
Loblaw has notified relevant law enforcement and regulatory authorities and is also offering credit monitoring and identity theft protection services to relevant individuals where appropriate.
If you receive an email or letter notice about this incident directly from Loblaw, that notice sets out the types of personal information about you that may have been involved in this incident and provides information on how to access complementary credit monitoring and identity theft protection services.
Who is contacting individuals?
In accordance with regulatory requirements, Loblaw is contacting individuals where appropriate and where we are able to through our trusted partner, Cyberscout, a division of TransUnion. Cyberscout has been authorized by Loblaw to contact individuals as part of our response effort.
Why does Loblaw have personal information?
Loblaw has personal information in connection with its relationship with customers through providing various services to them, in-store, online, or through an app, as well as other related customer services.
What should I do?
If you believe you have experienced fraud, you should report it to your local police service as well as to the Canadian Anti-Fraud Centre(Open in a new tab) at 1-888-495-8501.
As a general recommendation, and not in connection with this incident, we would encourage you to follow best practices from a security perspective, including the below steps:
Continue to be alert to the risk of phishing and fraudulent emails asking you to enter login credentials, provide financial information or ask for any other personal data.
Regularly review your account statements and monitor for any unfamiliar or unauthorized activity. If you notice anything unusual or experience difficulty accessing your account, please contact your account provider directly for assistance Use strong passwords and change them regularly. Use strong passwords by:
Using a minimum of 8 characters including upper and lower case letters, and at least 1 number and a symbol
Creating unique passwords for every online account including social networks, emails, financial and other accounts
Using a combination of passphrases that are easy for you to remember but hard for others to guess
Enable multi-factor authentication.
Protect yourself from spoofing by:
Never assuming that phone numbers appearing on your call display are accurate
Hang up and make the outgoing call when someone claims to be contacting you from your financial institution, service provider, law enforcement or government agency
Call the company or agency in question directly, if you receive a text message or email. Make sure you research their contact information and don't use the information provided in the first message
When visiting a website, always verify the URL and domain to make sure you are on the official website
If you have received a notification letter, we would encourage you to take advantage of the credit monitoring and identity theft protection offered through TransUnion.
Has the incident been resolved?
Yes, Loblaw worked closely with third-party cybersecurity experts to promptly contain the incident. No further unauthorized activity related to this incident has been observed.
Has the person(s) who accessed this information been caught?
As this matter involves an ongoing investigation, we are unable to provide further details. We have reported this incident to law enforcement authorities.
What is Loblaw doing to protect customers information moving forward?
Upon learning of the incident, Loblaw took multiple measures to contain the incident, remediate its impact, and implement additional security enhancements and further guardrails designed to help prevent similar incidents in the future. These measures include, as applicable:
Activating Loblaw’s incident response protocols and containment activities;
Engaging third-party cybersecurity specialists to assist with containing the incident, investigating its scope, and supporting remediation efforts;
Automatically logged customers out of Loblaw applications, which use Loblaw’s PCiD credentials (e.g., PC Optimum)
Implementing additional security enhancements designed to prevent similar incidents in the future
Has Loblaw reported this incident to relevant authorities?
Loblaw has reported this incident to relevant law enforcement and regulatory authorities.
