Loblaw data breach

What happened

Loblaw, Canada's largest food and pharmacy retailer (Shoppers Drug Mart, No Frills, Real Canadian Superstore, President's Choice), said on March 10, 2026 that it had found suspicious activity on a contained, non-critical part of its IT network and that a criminal third party had accessed basic customer information such as names, phone numbers and email addresses. It logged all customers out of their accounts and said passwords, health information and credit card data were not compromised and PC Financial was not affected. In late October 2026 Loblaw began notifying about two million Canadians directly. According to The Canadian Press, the exposed data may include name, email address, home address, date of birth, loyalty card number, certain purchase order details and partial payment card information, varying by person. The notices say the earliest unauthorized access was likely on February 23, 2026, and offer 24 months of free credit monitoring and identity restoration through TransUnion's myTrueIdentity, with enrolment open until February 28, 2027.

What should I do?

1. If you received a Loblaw notice, enrol in the free 24-month TransUnion myTrueIdentity credit monitoring using the code in your notice before February 28, 2027; Loblaw's support line for the incident is 1-833-811-9536.
2. Be wary of emails, texts and calls that mention your Loblaw or Shoppers Drug Mart account, orders or loyalty number, and don't click links or share passwords or card numbers in reply.
3. Check your loyalty points and online order history for activity you don't recognize, and change your password if you reuse it on other sites, even though Loblaw says passwords were not taken.
4. Watch your card statements, since partial payment card details may have been exposed for some customers, and report unfamiliar charges to your card issuer.

More data breaches in Canada →

Check the other services you use →