Loblaw faces proposed class action over breach affecting 2 million Canadians
Nov 10, 2026 · Summarized by Fundy Tech from 3 sources
A proposed Ontario class action says Loblaw failed to protect personal data for about two million Canadians and delayed direct notice. Loblaw says it will contest certification.
Key points
- The filing was made Nov. 2 in Ontario Superior Court.
- Loblaw said unusual activity was found in March.
- The company says it used extensive data analysis before notifying people.
The full story
A proposed class-action lawsuit has been filed in Ontario against Loblaw after a data breach earlier this year that allegedly compromised the personal information of about two million Canadian customers. The statement of claim, filed with the Ontario Superior Court of Justice on Nov. 2, says Loblaw failed to install effective safeguards and did not directly inform customers for months.
The filing says the case is only at an early stage. For it to proceed, a judge must certify the class action. Loblaw told Metroland Media that it has been served with the claim in Ontario and plans to contest certification.
According to the source, Loblaw said in March that it had identified unusual activity on its systems and logged customers out of the PC Optimum app as a security measure. The court filing alleges the company failed to contain the breach’s scope and impact and failed to directly inform affected people for several months after first discovering it.
The claim says the class includes all residents in Canada whose personal information was compromised in or around February 2026 and/or who were notified around October 2026. Loblaw’s compliance letter to the Office of the Privacy Commissioner of Canada said the timing of individual notices was due to extensive data analysis, de-duplication and validation to confirm the scope and who was affected. The same letter said the threat actor gained access to certain Loblaw systems using compromised credentials for a platform the company used, and that the earliest access was likely on Feb. 2026, though the text is truncated there.
Why it matters
Customers may want to watch for scams and account misuse if their data was part of the breach. For households, it also shows how long breach investigations can take before direct notices go out.
Who’s affected: Loblaw customers whose personal data was breached
What’s next
A judge must decide whether to certify the class action. Loblaw says it will contest certification.
What to do
- Watch for official notices from Loblaw.
- Change passwords if you use related accounts.
- Be alert for phishing or scam messages.
Original reporting
Not sure if this affects you?
Fundy Tech helps businesses and households across Atlantic Canada stay patched, protected and up to speed. Tell us what you’re running and we’ll tell you straight whether you need to act.