The grocer says an unauthorized party accessed names, addresses, phone numbers, birthdates and purchase details, with unauthorized activity detected in certain systems around February 23.
The Canadian
Newsroom
October 23, 2026
3 min read
Loblaw chief executive Per Bank has apologized to roughly two million customers after the company’s investigation concluded that an unauthorized party accessed personal information in a data breach earlier this year. CBC News reported on October 23 that the compromised information included names, addresses, phone numbers, birthdates and purchase details. The company is offering affected customers free credit monitoring.
According to the company’s account, unauthorized activity occurred in certain technology systems around February 23, 2026, and the activity was announced publicly in March. The confirmation this week that personal information was accessed — and the scale of roughly two million affected shoppers — is what is new. Loblaw operates about 2,500 stores across the country, making it Canada’s largest grocery retailer.
The exposed data points are the kind that fuel identity fraud: names and birthdates paired with addresses and phone numbers can be combined with information from other breaches to answer security questions or open fraudulent accounts. Purchase details add a further layer of sensitivity, revealing shopping habits that many customers would consider private. Credit monitoring can flag some misuse, but it does not undo the exposure.
The breach lands at a difficult moment for the grocery sector, which has spent two years under political and public pressure over food prices and has faced organized boycotts. A privacy failure affecting millions of shoppers adds a trust problem to a pricing problem, and it will renew questions about how much personal data loyalty programs and digital platforms collect in the first place.
Customers who receive a notification from Loblaw should take the credit-monitoring offer seriously and watch their financial statements. For the wider industry, the incident is another data point in a year of high-profile breaches: the question for regulators is whether Canada’s privacy penalties are large enough to change how retailers invest in protecting the data they hold.
The Canadian · October 28, 2026
The Canadian · October 23, 2026
The Canadian · October 17, 2026