October 13, 2026 Threats 6 min read

Loblaw Data Breach Update: How to Protect Your Business from Fake Notification Scams

By Cybersecurity Canada Editorial Team | Published October 13, 2026

Loblaw announced on October 2, 2026, that it will begin notifying customers affected by its March 2026 data breach in the coming weeks. The Loblaw data breach exposed names, addresses, phone numbers, email addresses, dates of birth, loyalty account numbers, certain purchase order details, and incomplete payment card information, according to Loblaw's official update. For Canadian small businesses, the concern is not the breach itself but what comes next: phishing emails and texts impersonating that legitimate notification.

Breach announcements create an opportunity for scammers. Customers who use the PC Optimum app and other Loblaw apps that use PCid may now be expecting an email that says "we regret to inform you." An inbox that would normally be suspicious of such a message may treat it as overdue. The Canadian Anti-Fraud Centre warns that "if you have been part of a breach or a victim of identity theft, fraudsters will use the information as a tool to steal your money."

The Office of the Privacy Commissioner of Canada's guidance on what to do when you receive a breach notification advises recipients to read the notice carefully, stay vigilant because fraudsters may wait before trying to steal your information, and contact the organization directly if you have questions about the communication.

What Did Loblaw Actually Say About the Breach?

Loblaw first disclosed the incident on March 10, 2026, stating that an unauthorized third party accessed names, phone numbers, and email addresses. At that time, Loblaw said passwords, health information, and credit card data were not compromised, and PC Financial was not affected. On October 2, 2026, Loblaw published an update that lists a broader set of information than the March statement: names, addresses, phone numbers, email addresses, dates of birth, loyalty account numbers, certain purchase order details, and incomplete payment card information. CP24 reported the March disclosure, and Grocery Business Magazine covered the October update.

Loblaw stated it will begin notifying impacted customers directly in the coming weeks. The company also encouraged customers to "continue practicing caution in relation to unexpected emails, calls or texts asking for personal information or asking you to click a link or download an attachment."

How Do Fake Loblaw Data Breach Notifications Work?

Phishing campaigns that impersonate breach notifications follow a consistent pattern. The attacker sends an email or text with correct branding, the recipient's name (often scraped from a prior data dump), and a subject line matching legitimate wording. The message claims your data was affected and asks you to "verify your identity" or "secure your account" by clicking a link.

The link leads to a fake login page or a form requesting your password, credit card, or Social Insurance Number. Once entered, attackers use the credentials for account takeover, financial fraud, or to launch business email compromise attacks against your contacts.

The timing is the whole trick: you are already expecting an email, so your normal suspicion is lowered. Legitimate notices explain what was exposed and point you to the company's official page. They do not ask you to click a link to confirm your identity or enter sensitive information.

What Should Canadian Businesses Tell Staff Right Now?

If your employees use the PC Optimum app or other Loblaw apps that use PCid, they may receive a real notification and multiple fakes. Share these five rules with your team this week:

1. Never click a link in an unexpected breach notification. Open a new browser tab, go to the company's official website, and check the newsroom or your account from there.
2. A real notice tells you what was exposed and asks for nothing. A phishing email pretends to inform you but needs something from you: a click, a password, a card number.
3. Verify before acting. If a message is urgent and unexpected, treat urgency as a red flag. Real institutions do not demand immediate action by email.
4. Report suspicious messages. A reported phishing attempt lets IT warn the rest of the team before someone else clicks. Forward suspicious emails to your IT lead or security contact.
5. Enable multi-factor authentication on every account that supports it. If credentials are phished, MFA stops the attacker from using them.

For a broader guide to Canadian brand phishing lures (CRA, Interac, Canada Post), see our phishing playbook for SMBs.

What Does PIPEDA Require If Your Business Has a Breach?

The Loblaw incident is a reminder that your own business may one day need to notify customers. Under the Personal Information Protection and Electronic Documents Act (PIPEDA), organizations must meet three obligations when a breach occurs:

1. Report to the Privacy Commissioner. If a breach of security safeguards involving personal information creates a "real risk of significant harm" (RROSH), you must report it to the Office of the Privacy Commissioner of Canada as soon as feasible. The OPC's guidance on mandatory breach reporting explains the threshold and required content.

2. Notify affected individuals. When a breach poses RROSH, you must notify affected individuals directly (by mail, email, phone, or in person). The notification must describe the circumstances, the information involved, the steps the organization has taken, and the steps individuals can take to protect themselves.

3. Keep records of all breaches. The Breach of Security Safeguards Regulations under PIPEDA require organizations to maintain a record of every breach for at least 24 months, whether or not it met the reporting threshold. These records must contain enough detail for the OPC to verify compliance if requested.

"Significant harm" under PIPEDA includes financial loss, identity theft, damage to reputation, and loss of employment or business opportunities. For more detail on the current enforcement landscape, see our guide to PIPEDA enforcement.

One Question to Ask Your IT Lead This Week

Before the next breach notification lands in an employee inbox (real or fake), ask your IT lead or provider: "Do we have a documented process for what happens when an employee reports clicking a suspicious link, and have we communicated that process to the team?"

If the answer is unclear, you have a starting point. Our free cybersecurity assessment evaluates your organization against the Canadian Centre for Cyber Security's Baseline Controls, including incident response and security training, in under 30 minutes.

Frequently Asked Questions

Cite This Page

Suggested citation:

Cybersecurity Canada (2026). Loblaw Data Breach Update: How to Protect Your Business from Fake Notification Scams. Retrieved from https://cybersecuritycanada.ca/news/posts/loblaw-data-breach-phishing-scams-how-canadian-smbs-should-respond/

Permanent URL: https://cybersecuritycanada.ca/news/posts/loblaw-data-breach-phishing-scams-how-canadian-smbs-should-respond/ · Published October 13, 2026