Loblaw faces national class action over February data breach affecting about two million Canadians

Two million Canadians who shopped at Loblaw's 2,500 stores may have had their names, addresses, birth dates and partial payment card information taken by a criminal third party. Customers have until Feb. 28, 2027 to enrol in two years of free credit monitoring through TransUnion. Loblaw is now facing a national class action over the breach.

The lawsuit was filed Nov. 2 in Ontario Superior Court of Justice by Consumer Law Group. It alleges the breach was intentional, wilful, reckless or at least negligent, and that affected customers were not notified until October 2026. The claim seeks unspecified damages and has not been certified.

Loblaw first disclosed the breach on March 10, 2026, saying it had identified suspicious activity around February and that names, phone numbers and email addresses were accessed. The company said passwords, health information and credit card data were not compromised, and that PC Financial was not affected. Its October 2, 2026 update widened the list to include addresses, dates of birth, loyalty account numbers, certain purchase order details and incomplete payment card information.

Loblaw CEO Per Bank has apologized to shoppers, and the company says it secured its network, logged all customers out of their accounts and notified regulators and police. A privacy expert quoted in a reporter 23 coverage described the TransUnion protection as limited.

The federal Office of the Privacy Commissioner of Canada says its investigation is ongoing. Loblaw signed a compliance letter on October 21, 2026, committing to additional security measures and an external security firm assessment, and the investigation stays open until those commitments are fulfilled.

Anyone who received a notice can enrol in the TransUnion monitoring before Feb. 28, 2027.