Loblaw Apologizes for Data Breach Affecting 2 Million Shoppers

A Loblaws grocery store is shown at a shopping centre in Bowmanville, Ont., on Feb. 28, 2023. The Canadian Press/Doug Ives

Loblaw has apologized to customers and is offering free credit monitoring after a data breach in March exposed the personal information of about 2 million shoppers.

The apology, sent directly to affected customers, comes three weeks after Loblaw issued an update on the breach.

“In the coming weeks we will begin notifying impacted customers directly,” the company said on Oct. 2. “These notifications will provide additional details about the incident, the steps we have taken to help protect impacted customers and the nature of information relating to the customer.”

The company said the stolen information included names, addresses, phone numbers, email addresses, dates of birth, loyalty account numbers, certain purchase order details, and incomplete payment card information.

The specific information affected varied by customer.

Loblaw said it has been working with law enforcement and urged customers to be cautious of unexpected emails, calls, or text messages requesting personal information or asking them to click links or download attachments.

“We take this matter seriously and remain committed to protecting our customers’ information,” the company said.

In an earlier statement published March 10, Loblaw said it was informing customers about the reason for forced logouts from its apps.

“We identified some unusual activity on a limited part of our system. Through our ongoing investigation, we determined that an unauthorized third-party accessed some basic customer details, including names, phone numbers, and email addresses,” it said, adding that credit card data, health information and passwords were not compromised.

The company said it had “refreshed” its system as part of its security response, causing customers to be logged out and be required to log in again.

Loblaw said it was offering free credit monitoring and had emailed affected customers to explain exactly what information had been compromised.

“In accordance with regulatory requirements, Loblaw is contacting individuals where appropriate and where we are able to through our trusted partner, Cyberscout, a division of TransUnion,” it said.

The company advises customers to watch for phishing attempts, use strong, unique passwords, and enable multi-factor authentication.

Anyone who suspects fraud should report it to local police and the Canadian Anti-Fraud Centre at 1-888-495-8501.

Loblaw encouraged customers who received a notification letter to take advantage of the available protections.

“If you have received a notification letter, we would encourage you to take advantage of the credit monitoring and identity theft protection offered through TransUnion,” it said.

The Canadian Press contributed to this report.