Class action filed against Loblaw over data breach affecting about two million people

TORONTO — Loblaw, one of Canada's largest grocery and pharmacy retailers, is facing a new class action after a cyberattack led to the leak of personal information belonging to about two million Canadians. The company is accused of failing to protect the data and of delaying notification of those affected.

Consumer Law Group filed the lawsuit in the Ontario Superior Court of Justice on November 2, 2026, seeking damages on behalf of customers affected by the breach.

The lawsuit follows confirmation from the Privacy Commissioner of Canada that the incident affected about two million people, and that the official investigation into the company's security practices remains open.

How did the Loblaw data breach happen?

The incident dates to February 2026, when hackers gained access to some of the company's systems using compromised login credentials for a platform used for quality monitoring.

According to the company's investigation, the unauthorized access most likely began on February 23. The breach was confirmed as discovered on March 5.

On March 10, Loblaw published a public notice about the incident and announced measures to contain it, including automatically logging users out of its apps.

The company said at the time that its initial investigation had not shown that passwords, health information or full credit card data were compromised, and that PC Financial services were not affected.

What information was leaked?

A later review showed that the affected data varies from customer to customer. It includes names, addresses, phone numbers, email addresses, dates of birth, loyalty account numbers, order details, and billing and delivery addresses.

Some records also contained incomplete payment card data, such as the last four digits, and not necessarily full card numbers.

The official report said additional information was affected for about 300 people, who will receive personalized notifications.

The group's brands include Loblaws, No Frills, Real Canadian Superstore, Zehrs and Fortinos, which gives the case a wide national reach.

Allegations of delayed notification

The lawsuit says the company did not notify affected individuals directly until October, even though the breach was discovered in March. It argues that this exposed consumers to risks that could have been addressed earlier.

However, documents from the Privacy Commissioner show that the company announced the incident publicly in March, then published an update on October 2 and began sending personal notifications on October 19.

Loblaw explained the delay in individual notifications by the need to review large volumes of records, remove duplicates, and verify the identities of those affected and the type of data involved.

Will customers receive financial compensation?

The lawsuit does not specify a fixed amount of compensation per person, and the court has not issued a ruling establishing the company's liability or allowing any payments to be distributed.

The class action has also not yet been certified by the court. This means that registering to follow developments is not the same as filing a claim, and does not guarantee payment or compensation.

The proposed class includes people residing in Canada whose data was affected by the breach, under conditions the court will determine.

A separate class action was also filed in Quebec on October 30, an indication that legal action linked to the incident is widening.

Credit monitoring and official investigation

The company offered some affected customers free credit monitoring and identity theft protection for 24 months through TransUnion. The plaintiffs consider this measure insufficient.

On October 21, Loblaw signed a letter of commitment with the Privacy Commissioner. It includes an independent review of its security practices and regular updates, while the investigation remains open.

Under the announced agreement, the company must provide confirmation to the Commissioner by November 16 that all affected people have been notified.

What should Loblaw customers do?

Customers are advised to review official messages from the company, monitor their accounts, be cautious of suspicious links, and change any reused passwords.

Those interested in the lawsuit can follow developments on the official Consumer Law Group page. There is currently no need to file a final compensation claim.

The amount of any potential compensation and the company's legal liability remain undecided until court rulings are issued, while the Privacy Commissioner continues to monitor the company's data protection commitments.