CBC Lite Sections News • Business Loblaw CEO apologizes to 2 million shoppers for personal data hack, offers free credit monitoring Jeff Lagerquist | CBC News | Posted: October 23, 2026 7:07 PM | Last Updated: October 23 Privacy expert says free credit monitoring offered by Loblaw provides limited protection Image | LOBLAW/ Caption: Brampton, Ont.-based Loblaw operates about 2,500 stores nationwide under its namesake Loblaws banner, as well as numerous sub-brands including No Frills, Real Canadian Superstore, Zehrs and Fortinos. (Chris Wattie/Reuters) (BUTTON) Load image Open image in new tab The CEO of Canada's largest grocery retailer is apologizing to about two million shoppers for a data breach earlier this year where hackers accessed private information, including names, addresses, phone numbers, birthdates and purchase details. Brampton, Ont.-based Loblaw operates about 2,500 stores nationwide under its namesake Loblaws banner, as well as numerous sub-brands including No Frills, Real Canadian Superstore, Zehrs and Fortinos. In March, Loblaw announced that unauthorized activity took place "in certain Loblaw technology systems" around Feb. 23. In an email this week to impacted customers, the company says its internal investigation found an "unauthorized third party" accessed certain personal information. "We know you trust us to protect your information, and we take that responsibility seriously," Loblaw CEO Per Bank states in the email seen by CBC News. "We're sorry for the concern this may cause, and are committed to supporting you and helping protect your information." WATCH | Loblaw returns country-of-origin labels to produce: Media Video | The National : Caption: Just weeks after removing country-of-origin labels from the produce section of most provinces' stores, Loblaw reversed the decision after being contacted by CBC News, and in the face of a renewed trade war with the U.S. and customer backlash. Open full embed in new tab Loading external pages may require significantly more data usage than loading CBC Lite story pages. As a precaution, Loblaw says customers were logged out of applications that use the company's PCiD credentials. These include loyalty programs like PC Optimum, the PC Express online grocery service and the PC Financial portal. The company is offering two years of free credit monitoring and identity restoration services through TransUnion. Impacted shoppers have until Feb. 28, 2027 to enroll. * Save-On-Foods loyalty program members had personal information accessed in cybersecurity breach * Crime Stoppers had 'potentially one of the most harmful data breaches' Canada has seen. What's next? Loblaw is also advising those who receive the email to "be cautious" about unexpected emails, calls or texts asking for personal information or asking you to click a link or download an attachment. "Keep an eye on your accounts and report any suspicious activity to the appropriate organization," the CEO says in the email. Understanding credit monitoring services Consumers should know that credit monitoring services offer limited protection, warned Cat Coode, a Waterloo, Ont.-based privacy and data strategist. "It only covers if someone is going to use your information in order to apply for a credit card or apply for certain government documents. It doesn't cover the spectrum of the things that you could do with that data," she told CBC News on Friday. "The privacy issue can never be resolved … Once your data is available, it is available. ... You can change your credit card number, but you can't change your birthdate." More than a 'slap on the wrist'? All organizations in Canada have a legal obligation to keep the personal information they collect safe, says Maanit Zemel, a Toronto-based lawyer who specializes in internet, privacy and cybersecurity law. "It's a regulatory obligation imposed by both federal and provincial privacy legislation." Federally, there is the Personal Information Protection and Electronic Documents Act. But Zemel calls PIPEDA, which officially came into force in 2001, "stuck in the 90s." The government introduced Bill C-36, the Protecting Privacy and Consumer Data Act, in June. It proposes a major overhaul of Canada's private sector privacy framework, updating language to establish privacy as a "fundamental right" and replacing parts of PIPEDA. * New privacy bill would give Canadians right to request companies delete AI deepfakes The bill also requires companies to conduct a "privacy impact assessment" before transferring personal data outside of Canada. If passed, Zemel says the new legislation will significantly up the consequences for companies found to have mishandled the personal data of customers. "It's no longer going to be a slap on the wrist," he said. "There's going to significant consequences for a potential failure to comply with these requirements, including appropriate security safeguards." More Stories Like This The related links below are generated automatically based on the story you’ve just read. Loading... CBC Lite is a low-bandwidth website. To see what's new, check out our release notes. For high quality images, media, comments, and other additional features visit the full version of this story. Theme preference[Auto_] Contrast preference[Auto___] We and select advertising partners use trackers to collect some of your data in order to enhance your experience and to deliver personalized content and advertising. If you are not comfortable with the use of this information, please review your device and browser privacy settings before continuing your visit. Learn more about Online Tracking and Privacy Choices. * Corrections and Clarifications * Terms of Use * Reuse & Permission * Privacy Notice * Accessibility * Contact a Newsroom * Submit Feedback * Lite Help Centre * Jobs * RSS CBC Lite version: 1.9.1. ©2026 CBC/Radio-Canada. All rights reserved.