What happened
In March 2026 Loblaw, the company behind Loblaws, No Frills, Real Canadian Superstore, Zehrs, Fortinos and PC Optimum, said someone got into part of its IT network around late February. At the time it called it a low-level breach and said names, phone numbers and emails were accessed. Everyone using PC Optimum, PC Express and other apps that sign in with PCid got logged out as a precaution.
On October 23, 2026 Loblaw said it is now notifying about 2 million Canadians directly, by email or letter, with the specific details that were taken for each person.
What data was exposed
Loblaw says it varies by customer, and not everyone had every type taken. The list includes name; home address, plus billing and shipping addresses; phone number; email address; date of birth; loyalty account number (PC Optimum); certain purchase order details; and incomplete (partial) payment card numbers.
Loblaw says passwords, health information and full credit card data were not compromised, and PC Financial was not affected.
What to do now
- 01Look for the official notice. Your email or letter says which of your details were involved. If you got one, Loblaw is offering 2 years of free credit monitoring and identity restoration through TransUnion. You have until Feb. 28, 2027 to enroll.
- 02Treat Loblaw or PC Optimum messages with links as suspicious for a while. Scammers love a fresh breach with real names and addresses. Open the app or type the site in yourself instead of tapping a link.
- 03Check your PC Optimum points. Points theft is a common follow up when loyalty numbers leak. If anything looks off, call PC Optimum through the number on the official site.
- 04Partial card numbers cannot be used to buy things on their own, but they make bank calling scams more convincing. Your bank will not ask for your full number or PIN.
- 05Credit monitoring only catches new credit in your name. If your birth date and address were in your notice, think about adding a fraud alert with Equifax and TransUnion Canada too.
How to check if you were affected
The Loblaw notice is the only way to know for sure you are in this specific breach. Loblaw has an FAQ at loblaw.ca.
Have I Been Pwned is free and shows public breaches tied to your email once the data has been verified and loaded there.
OSINT Pro's email lookup shows where your email has turned up across breach data and stealer logs. We are not claiming it includes Loblaw data unless that is later confirmed.