The Loblaw breach: what was taken, and what to do now

On October 2, 2026, Loblaw published an update on the data breach it first disclosed in March. The company says it has finished reviewing what was taken and will start notifying affected customers directly “in the coming weeks.” If you shop at Loblaws, No Frills, Maxi, Real Canadian Superstore or Shoppers Drug Mart, or use PC Optimum, here is what we know, what it means, and what’s worth doing.

What happened

On March 10, 2026, Loblaw said it had found suspicious activity on “a contained, non-critical part of its IT network” and that a criminal third party had accessed basic customer information: names, phone numbers and email addresses. As a precaution, it signed every customer out of the PC Optimum app and other apps that use PCid, so everyone had to sign back in. At the time, Loblaw said its investigation showed passwords, health information and credit card data were not compromised, and that PC Financial was not affected.

The October 2 update is broader. After a detailed review, Loblaw says the exposed information varied by customer, and not every type applied to everyone, but included:

• name, address, phone number and email address
• date of birth
• loyalty account number
• certain purchase order details
• incomplete payment card information

Loblaw says it notified law enforcement and regulators. It hasn’t published how many people are affected.

What this means for you

“Incomplete payment card information” usually means something like the last four digits, not a full card number someone could charge. Loblaw hasn’t said which parts were exposed, so wait for your notice for specifics. Your card issuer’s fraud protection still applies either way.

The bigger risk is quieter. A name, home address, birth date, phone number and email in one record is exactly what a convincing scam needs. Someone who knows what you bought and your PC Optimum number can write a very believable “problem with your order” text or email.

Breached data rarely gets used the day it’s stolen. It gets used months later, by someone pretending to be a company you trust.

What to do now

1. Expect the real notice, and treat look-alikes with suspicion. Loblaw says it will contact affected customers directly. Scammers know that too. Don’t click links in a message about the breach; go to loblaw.ca or the PC Optimum app yourself.
2. Never give a password or one-time code to someone who contacted you. Loblaw, your bank and Frame will never ask for them by phone, text or email.
3. Check your PC Optimum account. Look for redemptions you didn’t make. Points are worth real money, so they’re worth a quick look.
4. Watch your card statements. Report anything you don’t recognise to your card issuer.
5. Consider a credit lock or fraud alert. Your birth date and address are the pieces used to open accounts in your name. If you live in Quebec, or in Ontario since July 1, 2026, you can lock your credit file for free. Elsewhere, you can ask Equifax and TransUnion for a fraud alert. Our after-a-breach checklist covers how.

You don’t need to change your birth date (you can’t), and you don’t need to panic. You do need to be a little more skeptical of messages that seem to know a lot about you for the next while.

How Frame helps

Frame keeps a catalog of known breaches and lets you mark the ones you know you were part of, so your exposure report and to-dos reflect them. We never collect or store the leaked records themselves.

Sources

• Loblaw, “Loblaw Notifies Customers of a Low-Level Data Breach”, March 10, 2026
• Loblaw, “Important Information About Your Account”, updated October 2, 2026
• Reuters via MarketScreener, “Canadian retailer Loblaw investigates data breach”, March 10, 2026
• BleepingComputer, “Canadian retail giant Loblaw notifies customers of data breach”
• Equifax Canada, Credit lock FAQ (Quebec and Ontario)