Loblaw CEO apologizes to 2 million shoppers for personal data hack, offers free credit monitoring

The CEO of Canada’s largest grocery retailer is apologizing to about two million shoppers for a data breach earlier this year.

In an email to impacted shoppers, Loblaw CEO Per Bank said: 'We’re sorry for the concern this may cause'

Jeff Lagerquist · CBC News

· Posted: Oct 23, 2026 3:07 PM EDT | Last Updated: 13 minutes ago

Listen to this article

Estimated 3 minutes

The audio version of this article is generated by AI-based technology. Mispronunciations can occur. We are working with our partners to continually review and improve the results.

The CEO of Canada's largest grocery retailer is apologizing to about two million shoppers for a data breach earlier this year where hackers accessed private information, including names, addresses, phone numbers, birthdates and purchase details. 

Brampton, Ont.-based Loblaw operates about 2,500 stores nationwide under its namesake Loblaws banner, as well as numerous sub-brands including No Frills, Real Canadian Superstore, Zehrs and Fortinos. 

In March, Loblaw announced that unauthorized activity took place "in certain Loblaw technology systems" around Feb. 23. In an email this week to impacted customers, the company says its internal investigation found an "unauthorized third party" accessed certain personal information.

"We know you trust us to protect your information, and we take that responsibility seriously," Loblaw CEO Per Bank states in the email seen by CBC News. "We're sorry for the concern this may cause, and are committed to supporting you and helping protect your information."

WATCH | Loblaw returns country-of-origin labels to produce:

Loblaw stores returning produce country-of-origin labels after backlash

August 25|

Duration

1:46

Just weeks after removing country-of-origin labels from the produce section of most provinces' stores, Loblaw reversed the decision after being contacted by CBC News, and in the face of a renewed trade war with the U.S. and customer backlash.

As a precaution, Loblaw says customers were logged out of applications that use the company's PCiD credentials. These include loyalty programs like PC Optimum, the PC Express online grocery service and the PC Financial portal. 

The company is offering two years of free credit monitoring and identity restoration services through TransUnion. Impacted shoppers have until Feb. 28, 2027 to enroll.

• Save-On-Foods loyalty program members had personal information accessed in cybersecurity breach

• CBC Investigates

  Crime Stoppers had 'potentially one of the most harmful data breaches' Canada has seen. What's next?

Loblaw is also advising those who receive the email to "be cautious" about unexpected emails, calls or texts asking for personal information or asking you to click a link or download an attachment.

"Keep an eye on your accounts and report any suspicious activity to the appropriate organization," the CEO says in the email.

Understanding credit monitoring services

Consumers should know that credit monitoring services offer limited protection, warned Cat Coode, a Waterloo, Ont.-based privacy and data strategist.

"It only covers if someone is going to use your information in order to apply for a credit card or apply for certain government documents. It doesn't cover the spectrum of the things that you could do with that data," she told CBC News on Friday.

"The privacy issue can never be resolved … Once your data is available, it is available. ... You can change your credit card number, but you can't change your birthdate."

ABOUT THE AUTHOR

Jeff Lagerquist is a senior writer with CBC News based in Toronto. Originally from Erin, Ont., he studied journalism at Toronto Metropolitan University. Jeff previously worked as a senior reporter for Yahoo Finance Canada. He was also a reporter and digital producer for CTV National News, BNN Bloomberg and The Financial Post. In 2025, he was a Columbia University energy journalism fellow.