The CEO of Canada’s largest grocery retailer is apologizing to about two million shoppers for a data breach earlier this year where hackers accessed private information, including names, addresses, phone numbers, birthdates and purchase details.
Brampton, Ont.-based Loblaw operates about 2,500 stores nationwide under its namesake Loblaws banner, as well as numerous sub-brands including No Frills, Real Canadian Superstore, Zehrs and Fortinos.
In March, Loblaw announced that unauthorized activity took place “in certain Loblaw technology systems” around Feb. 23. In an email this week to impacted customers, the company says its internal investigation found an “unauthorized third party” accessed certain personal information.
“We know you trust us to protect your information, and we take that responsibility seriously,” Loblaw CEO Per Bank states in the email seen by CBC News. “We’re sorry for the concern this may cause, and are committed to supporting you and helping protect your information.”
Loblaw stores returning produce country-of-origin labels after backlash
As a precaution, Loblaw says customers were logged out of applications that use the company’s PCiD credentials. These include loyalty programs like PC Optimum, the PC Express online grocery service and the PC Financial portal.
The company is offering two years of free credit monitoring and identity restoration services through TransUnion. Impacted shoppers have until Feb. 28, 2027 to enroll.
Save-On-Foods loyalty program members had personal information accessed in cybersecurity breach
Crime Stoppers had ‘potentially one of the most harmful data breaches’ Canada has seen. What’s next?
Loblaw is also advising those who receive the email to “be cautious” about unexpected emails, calls or texts asking for personal information or asking you to click a link or download an attachment.
“Keep an eye on your accounts and report any suspicious activity to the appropriate organization,” the CEO says in the email.
Consumers should know that credit monitoring services offer limited protection, warned Cat Coode, a Waterloo, Ont.-based privacy and data strategist.
“It only covers if someone is going to use your information in order to apply for a credit card or apply for certain government documents. It doesn’t cover the spectrum of the things that you could do with that data,” she told CBC News on Friday.
“The privacy issue can never be resolved … Once your data is available, it is available. … You can change your credit card number, but you can’t change your birthdate.”
All organizations in Canada have a legal obligation to keep the personal information they collect safe, says Maanit Zemel, a Toronto-based lawyer who specializes in internet, privacy and cybersecurity law.
“It’s a regulatory obligation imposed by both federal and provincial privacy legislation.”
Federally, there is the Personal Information Protection and Electronic Documents Act. But Zemel calls PIPEDA, which officially came into force in 2001, “stuck in the 90s.”
The government introduced Bill C-36, the Protecting Privacy and Consumer Data Act, in June. It proposes a major overhaul of Canada’s private sector privacy framework, updating language to establish privacy as a “fundamental right” and replacing parts of PIPEDA.
New privacy bill would give Canadians right to request companies delete AI deepfakes
The bill also requires companies to conduct a “privacy impact assessment” before transferring personal data outside of Canada.
If passed, Zemel says the new legislation will significantly up the consequences for companies found to have mishandled the personal data of customers.
“It’s no longer going to be a slap on the wrist,” he said. “There’s going to significant consequences for a potential failure to comply with these requirements, including appropriate security safeguards.”
