Loblaw starts notifying 2 million Canadians affected by March data breach
Months after detecting unauthorized access to customer data, Loblaw says it is now notifying about two million Canadians whose personal information may have been exposed. The company is offering free credit monitoring and identity restoration services through TransUnion as it details what data was involved for each affected customer.
Highlights
- Loblaw has begun notifying 2 million Canadians whose personal data, including names and partial payment details, was compromised in a March breach.
- The company is offering affected customers free TransUnion credit monitoring and identity restoration services, advising vigilance against suspicious communications.
- Following detection of the breach, Loblaw investigated, informed authorities, and enhanced its security systems, clarifying the significant scope for Canada's retail sector.
Customer notifications and support measures
As reported by Moneysense, Loblaw says it is beginning to contact affected consumers directly with details on which pieces of their personal information were exposed in the March breach.The grocer says the compromised data may include names, email addresses, home addresses, dates of birth, loyalty card numbers, certain purchase order details and partial payment card information. It adds that the scope of the exposure varies by individual, and not every type of information was involved for every customer.
Loblaw is also advising customers on next steps and warning them to watch for unexpected emails, calls or text messages. It is offering complimentary credit monitoring and identity restoration services through TransUnion.
March incident and follow-up actions
The company said in March that it detected suspicious activity on its IT network and found that an unauthorized third party had accessed some basic customer information. At that time, it did not disclose how many customers were affected.Loblaw says it has since carried out a detailed investigation, notified law enforcement and regulatory authorities, and strengthened its security systems. The disclosure gives a clearer sense of the scale of the incident for Canada's retail and consumer data landscape.
In our earlier coverage of CTOS Digital’s cybersecurity incident, we examined how the breach and resulting service disruptions were expected to hit the company’s financial performance. We noted management’s estimate that profit and revenue would decline if some services stayed unavailable into late October, and that each additional week of disruption could further weigh on results.