Loblaw: customer data taken from IT systems, PC Optimum sessions reset

What happened

• Loblaw’s notice says an unauthorized third party accessed customer information after activity detected around 5 Mar 2026. The March notice listed names, phone numbers and email addresses; the 2 Oct 2026 update adds addresses, dates of birth, loyalty account numbers, some purchase-order details, incomplete payment card information and billing and shipping addresses, varying by customer. Loblaw says passwords and health information were not compromised and PC Financial was unaffected. No count given by Loblaw.
• Root cause: not disclosed.
• No attacker named by Loblaw; a threat actor’s claim of 1.8 billion records is unverified.
• Forced re-login for all PCid apps, notified regulators and law enforcement, offering TransUnion Cyberscout monitoring, direct notices from October 2026.

Sources

• https://www.loblaw.ca/en/real-talk-important-information-about-your-account/
• https://canadiangrocer.com/loblaw-says-some-customers-affected-data-breach

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.