October 26, 2026
In the context of an investigation initiated by Privacy Commissioner of Canada Philippe Dufresne, Loblaw Companies Ltd. has committed to take actions aimed at strengthening its security measures following a cyberattack that impacted approximately two million Canadians.
The breach occurred in February 2026 when Loblaw experienced a cybersecurity incident in which a hacking group gained access to its systems and customer account information.
In March 2026, Loblaw took steps to contain the breach with help from a third-party cybersecurity firm and posted a public notice about the incident on its website and via an in-app message to users of its PC Optimum application. The company also notified the Office of the Privacy Commissioner of Canada (OPC) about the matter. Loblaw recently updated its public notice and has started directly notifying individuals who have been impacted by the breach.
The OPC has remained engaged with Loblaw to ensure that appropriate steps were being taken to respond to the breach.
In a compliance letter with the OPC that Loblaw signed on October 21, 2026, the company agreed to take additional measures to meet its obligations under Canada’s federal private-sector privacy law and prevent future breaches. This includes a plan to engage an external security firm to assess the effectiveness of its enhanced measures and to inform the OPC on how it will address any additional recommendations made by the firm.
Voluntary compliance letters are an example of Commissioner Dufresne’s efforts to resolve privacy issues more efficiently and expeditiously with companies that are motivated to improve their practices in order to mitigate risks to Canadians.
The Commissioner’s investigation will remain open until he is satisfied that Loblaw has fulfilled all its commitments.
Read more at the Office of the Privacy Commmissioner of Canada.