Breaches

Loblaw tells 2m shoppers their data was taken in March breach

Loblaw is notifying 2m customers seven months after its breach, with partial card data now listed. What it means for UK loyalty schemes and UK GDPR.

Padlock graphic with the headline Loblaw breach reaches two million shoppers

Loblaw, Canada’s largest grocer, has started writing to around two million shoppers about a breach it first disclosed in March, and the list of exposed data now includes partial payment card details. For UK retailers that run loyalty schemes, the seven-month wait between the first announcement and the individual letters is the part to study.

What happened

On 23 October 2026 Loblaw Companies confirmed that it was contacting roughly two million Canadians directly to explain which of their personal details had been exposed. According to The Canadian Press, the exposed fields may include names, email and home addresses, dates of birth, loyalty card numbers, some order details and partial payment card data. Loblaw says the mix differs from customer to customer, so not everyone lost every field.

Chief executive Per Bank signed the email. CBC News, which saw a copy, reports that he told customers Loblaw was “sorry for the concern this may cause”. Affected shoppers get 24 months of TransUnion credit monitoring and identity restoration at no cost, with enrolment open until 28 February 2027.

The incident itself is not new. In March, Loblaw said it had found suspicious activity in a contained part of its network that it described as non-critical, and that a criminal third party had accessed basic customer details. CBC reports that the company dated the unauthorised activity to around 23 February. At the time Loblaw did not say how many people were affected, and it logged every customer out of services that use its shared PCiD sign-in, including the PC Optimum loyalty programme, PC Express online grocery and the PC Financial portal.

The detail

Put the two announcements side by side and the change is obvious. In March, Loblaw and the coverage of its statement in BleepingComputer and Canadian Grocer described the exposed data as basic details, citing names, phone numbers and email addresses. The company added that its investigation had found no sign that credit card details, health information or passwords had been compromised. The October notices go much further: home addresses, dates of birth, loyalty numbers, order details and partial card data are now on the list.

That need not mean the March statement was wrong: early findings are often provisional, and retail forensics can take months. Still, customers were reassured early, and the full picture has taken seven months to reach them.

Loblaw has not said how the attacker got in, which systems held the data or whether anyone has tried to extort the company. In March, BleepingComputer found no group claiming the attack and no Loblaw data on sale, and the October reporting reviewed for this article does not suggest otherwise.

The shared sign-in matters. PC Optimum, PC Express and the PC Financial portal all trust the same PCiD credentials, which turns the identity platform into a single point whose compromise touches most of what a customer does with the group. Logging everyone out was the right containment step.

Timeline of the Loblaw data breach from unauthorised activity in February 2026 to the February 2027 credit monitoring enrolment deadline

Why it matters for UK organisations

Under UK GDPR, a controller has 72 hours from becoming aware of a reportable breach to tell the ICO, where feasible. Where people face a likely high risk, the controller must also tell those people without undue delay. The ICO’s guidance says notification can be staged, so an organisation can report before it knows everything and add detail later. What it cannot do is let the people at risk wait until the investigation is neat and finished.

Dates of birth combined with home addresses, loyalty numbers and partial card details are exactly the kind of data that pushes a breach towards high risk. A birth date cannot be changed. Partial card details and purchase history let a fraudster pass themselves off as the retailer or the bank on the phone. A UK retailer that announced “contact details only”, then waited seven months to tell individuals that much more had gone, would face hard questions from the ICO about when it knew what, and why customers were not told sooner.

There is also a closer link. Wittington Investments, the Weston family holding company (the Westons built Loblaw), agreed on 7 October to buy Boots, with completion expected in the first quarter of 2027, according to The Canadian Press. Wittington is a separate business from Loblaw, and nothing suggests Boots systems are involved in this incident. Even so, Boots is one of Britain’s most prominent retailers, with roughly 1,800 UK stores, and anyone planning the integration should be reading this case closely.

More widely, loyalty databases are an attractive target for attackers going after UK retail. They hold years of identity and behaviour data, link to payment and app accounts, and are often spread across third-party marketing platforms.

Expert view

In my experience, loyalty platforms are one of the weakest parts of a retailer’s estate. They grow through campaigns and acquisitions, they replicate data into analytics and marketing tools, and nobody owns the full data map. When we test retail environments, the customer identity service is usually well protected at the front door, while the reporting databases and export jobs behind it get far less attention.

The Loblaw timeline shows a second, quieter problem: early statements. Saying early on that no card or sensitive data was involved is a hostage to fortune. The better approach is to describe what you have confirmed, say plainly what you are still checking, and commit to a date for the next update. Regulators and customers forgive uncertainty far more readily than a reassurance that later falls apart.

Credit monitoring is a reasonable gesture, but it does little against the likeliest harm: convincing phishing and phone fraud built on the leaked details.

What to do now

  1. Map your loyalty data. Record every system, data warehouse and third-party platform holding loyalty member data, including exports and test copies. You cannot judge breach scope quickly without this.
  2. Harden the shared identity layer. Enforce MFA for administrative access to customer identity platforms, review service accounts and API keys, and apply least privilege. These map directly to the Cyber Essentials user access control and secure configuration requirements.
  3. Retain the logs that answer scope questions. Make sure database, application and cloud audit logs are kept long enough, and are detailed enough, to show which records were actually read or exported.
  4. Plan for staged notification. Write templates for an initial ICO report and for follow-ups, and set internal triggers for re-assessing high risk to individuals as the investigation finds more.
  5. Avoid early absolutes. Public statements should separate confirmed facts from open questions and must not rule out data categories until forensics supports that.
  6. Prepare customers for scams. Publish how you will contact people after an incident, and keep patching and malware protection current on the systems behind customer channels.

Bottom line

Loblaw has contained the incident, apologised and offered monitoring. Many of its customers, though, may have spent months believing their exposure was limited to contact details. UK GDPR expects people at high risk to hear promptly, even when the facts are incomplete, and UK retailers holding large loyalty datasets should check now that their own investigation and notification plans would meet that standard.

Sources

Related Posts