Listen to this article
Estimated 3 minutes
The audio version of this article is generated by AI-based technology. Mispronunciations can occur. We are working with our partners to continually review and improve the results.
The CEO of Canada’s largest grocery retailer is apologizing to about two million shoppers for a data breach earlier this year where hackers accessed private information, including names, addresses, phone numbers, birthdates and purchase details.
Brampton, Ont.-based Loblaw operates about 2,500 stores nationwide under its namesake Loblaws banner, as well as numerous sub-brands including No Frills, Real Canadian Superstore, Zehrs and Fortinos.
In March, Loblaw announced that unauthorized activity took place “in certain Loblaw technology systems” around Feb. 23. In an email this week to impacted customers, the company says its internal investigation found an “unauthorized third party” accessed certain personal information.
“We know you trust us to protect your information, and we take that responsibility seriously,” Loblaw CEO Per Bank states in the email seen by CBC News. “We’re sorry for the concern this may cause, and are committed to supporting you and helping protect your information.”
Just weeks after removing country-of-origin labels from the produce section of most provinces’ stores, Loblaw reversed the decision after being contacted by CBC News, and in the face of a renewed trade war with the U.S. and customer backlash.
As a precaution, Loblaw says customers were logged out of applications that use the company’s PCiD credentials. These include loyalty programs like PC Optimum, the PC Express online grocery service and the PC Financial portal.
The company is offering two years of free credit monitoring and identity restoration services through TransUnion. Impacted shoppers have until Feb. 28, 2027 to enroll.
Loblaw is also advising those who receive the email to “be cautious” about unexpected emails, calls or texts asking for personal information or asking you to click a link or download an attachment.
“Keep an eye on your accounts and report any suspicious activity to the appropriate organization,” the CEO says in the email.
Understanding credit monitoring services
Consumers should know that credit monitoring services offer limited protection, warned Cat Coode, a Waterloo, Ont.-based privacy and data strategist.
“It only covers if someone is going to use your information in order to apply for a credit card or apply for certain government documents. It doesn’t cover the spectrum of the things that you could do with that data,” she told CBC News on Friday.
“The privacy issue can never be resolved … Once your data is available, it is available. … You can change your credit card number, but you can’t change your birthdate.”
