If you got a Loblaw breach notice, enroll in the free 24-month TransUnion myTrueIdentity monitoring before February 28, 2027, change your PCiD password, and watch your card statements. Loblaw says about two million Canadians had names, addresses, birth dates, loyalty numbers and partial card numbers exposed. Passwords were not taken.
The Short Version
Attackers reached part of Loblaw's IT network as early as February 23, 2026. Loblaw found the activity in March and called it "low-level" at the time. On October 22–23, 2026, it began emailing about two million affected customers. The exposed data is exactly what convincing phishing calls and texts need. Expect scam attempts that quote your real address, birthday or card digits.
What Happened in the Loblaw Data Breach
Loblaw Companies Ltd. is Canada's largest grocer and pharmacy operator. Its banners include Loblaws, No Frills, Real Canadian Superstore and Shoppers Drug Mart, and it runs the PC Optimum loyalty program. In March 2026 it announced that it had detected suspicious activity on a "contained, non-critical part" of its IT network. At that point it said the exposed data was limited to basic customer details such as names, phone numbers and email addresses.
The full picture came months later. After a forensic review, Loblaw said on October 2, 2026 that it would contact affected customers directly. Notification emails started arriving on October 22 and 23. The company now puts the number of affected Canadians at about two million. It believes the earliest unauthorized access to its network was on February 23, 2026.
As a precaution, Loblaw logged customers out of every app that uses a PCiD login. That includes PC Optimum, PC Express and the PC Financial portal. The company says it has added security safeguards and reported the incident to privacy regulators and law enforcement.
What Data Was Exposed
Loblaw says the data involved varies by person, and not every customer had every field exposed. Across the affected group, the data includes:
- Full name
- Email address and phone number
- Home address
- Date of birth
- Loyalty account number (PC Optimum)
- Certain purchase order details
- Incomplete payment card information. Sample notices show the card's expiry date plus the first six or eight digits and the last four digits.
What Loblaw says was not exposed
Loblaw says no account passwords, health information or complete payment card numbers were taken. It says PC Financial data was likely not compromised, and stores and payment systems kept running normally.
Partial Card Numbers Are Still Useful to Scammers
Nobody can make a purchase with the first eight and last four digits of your card. A scammer can still read those digits back to you, with your name and expiry date, in a fake "fraud department" call. Your bank will never ask you to confirm a full card number, CVV or one-time code. If a caller does, hang up and call the number on the back of your card.
Step 1: Confirm the Notice Is Real
Fake breach notices follow every big breach. Loblaw's real notice comes by email and includes an activation code for TransUnion's monitoring service. Never enter card details or passwords through a link in an email or text. If you are unsure, sign in to PC Optimum directly in the app or by typing the address yourself, or check Loblaw's breach page from its official site. Our guide to spotting fake breach notification scams covers the common tricks.
Step 2: Enroll in the Free TransUnion Monitoring
Loblaw is offering 24 months of free credit monitoring and identity restoration through TransUnion's myTrueIdentity service. Use the activation code in your notice. The enrollment deadline is February 28, 2027, and after that date the code stops working. It costs nothing and it will alert you if someone opens credit in your name using your stolen name, address and birth date.
Step 3: Reset Your PCiD Password and Turn On Extra Protection
Loblaw says passwords were not taken, and it has already signed everyone out. Still, set a new, unique PCiD password the next time you sign in. If you used the same password anywhere else, change it there too. Use a password manager so every account gets its own password. Then check your PC Optimum points balance and redemption history. Loyalty points are a favourite target because they work like cash and are rarely watched. Our guide on what to do if your loyalty account is hacked walks through recovery.
Is your data already out there?
Leaked data ends up on broker sites and in scammers' hands. Run a free 60-second scan to see your exposure — then let us remove it.
Run a free scan★★★★★ 4.8/5 · Trusted by thousands of families
Step 4: Watch Your Card and Bank Statements
Review your card statements every week for the next few months. Tell your card issuer that the card appeared in the Loblaw breach. Many issuers will replace the card for free, which makes the leaked digits useless. If you see a charge you don't recognise, follow our steps for when your credit card information is stolen.
Step 5: Add a Fraud Alert With Canada's Credit Bureaus
Canada has two consumer credit bureaus: Equifax Canada and TransUnion Canada. Both let you add a fraud alert to your file for free. It tells lenders to verify your identity before approving new credit. Quebec residents can also place a full security freeze, which provincial law requires the bureaus to offer. Because your date of birth and home address were exposed, a fraud alert is a reasonable step even if you enroll in monitoring.
Step 6: Treat Every Unexpected Call, Text and Email as Suspicious
Loblaw itself is warning customers to be careful with unexpected messages that ask for personal information, links or downloads. With your real name, address, birthday and purchase details, a scammer can sound very convincing. Common scripts to expect:
- A "Loblaw security team" asking you to verify your card
- A fake PC Optimum message saying your points are about to expire
- A fake "breach compensation" or class-action sign-up form asking for banking details
- Texts about a delivery or order that quote a real past PC Express purchase
Read our guide to spotting smishing texts before replying to anything.
Step 7: Shrink What Else Is Out There About You
Breach data rarely stays in one place. Attackers combine it with what people-search sites and data brokers already publish, such as your relatives, phone numbers, past addresses and age. That turns a partial record into a complete identity profile. The less of your information is publicly listed, the harder it is to build a believable scam around you.
That is the job PrivacyOn does. It removes your personal information from 100+ data broker and people-search sites and keeps checking for new listings. It also monitors the dark web around the clock for your email, phone number and other details. Plans start at $8.33/month and cover up to 5 family members. See how it compares in our roundup of the best data removal services, or run a free PrivacyOn scan to see where your information is exposed right now.
Frequently Asked Questions
How do I know if I was affected by the Loblaw data breach?
Loblaw is emailing affected customers directly, starting October 22–23, 2026. Each notice includes an activation code for free TransUnion monitoring. If you have a PC Optimum or other PCiD account and did not get an email, check your spam folder. You can also contact Loblaw through its official website rather than any link in a message.
Were my PC Optimum password or credit card numbers stolen?
Loblaw says passwords and complete card numbers were not taken. Some customers did have partial card information exposed: the expiry date plus the first six or eight digits and last four digits. That is not enough to make purchases, but it is enough to make a fake bank call sound real.
How long is the free credit monitoring, and when is the deadline?
Loblaw is offering 24 months of TransUnion myTrueIdentity credit monitoring and identity restoration at no cost. You must enroll with the code in your notice by February 28, 2027.
How many people were affected by the Loblaw breach?
About two million Canadians, according to Loblaw. The company believes attackers first got into its network on February 23, 2026, and it detected the activity in March 2026.
Is free credit monitoring enough after the Loblaw breach?
No. Credit monitoring only tells you after someone has used your identity to apply for credit. It does nothing about the scam calls, texts and emails that leaked contact details invite. It also does nothing about the people-search sites that publish your address and phone number for anyone to look up. Pair the free monitoring with PrivacyOn, which removes your data from 100+ brokers, monitors the dark web 24/7 and covers up to 5 family members from $8.33/month.
Should I cancel my PC Optimum account?
Deleting your account will not pull back data that was already stolen, so it does not undo this breach. If you keep the account, use a unique password and check your points regularly. If you close it, ask Loblaw to delete your stored purchase history as well. Canada's Privacy Commissioner found in March 2026 that Loblaw had been slow to handle PC Optimum deletion requests.