Loblaws Data Breach Canadian Class Action

CONSUMER LAW GROUP has filed a national class action lawsuit against Loblaws Inc. and its parent company Loblaw Companies Limited in relation to a massive data breach that exposed the private information provided by 2 million Canadians.

The Loblaw group of companies form Canada’s largest grocery retailer chain and includes 2,500 stores under the names Loblaws, No Frills, Real Canadian Superstore, Zehrs, and Fortinos.

On March 10, 2026, the Loblaws Defendants issued a press release stating that it was investigating a data breach “[a]fter identifying suspicious activity” on its IT network. Loblaws also stated that it “determined that a criminal third-party accessed some basic customer information such as names, phone numbers, and email addresses” on or around February 23, 2026.

Loblaws did not notify affected consumers until on or around October 29, 2026 in an email signed by the President and CEO of Loblaws Companies Limited. The email confirms that personal information compromised in the data breach includes consumers’ names, email address, home address, phone number, date of birth, payment information, purchase order details and billing and shipping address.

The exfiltrated personal information of Plaintiff and Class Members is so sensitive that it exposes them to an increased and significant realistic risk of harm, including identity theft, fraud, and other financial and personal damage that will endure for many years to come

Loblaws’ data security practices and notification of consumers are the subject of an ongoing investigation by the Office of the Privacy Commissioner of Canada. The Office also confirmed that it entered into a compliance letter with the Loblaw Defendants on October 21, 2026 pursuant to the federal Personal Information Protection and Electronic Documents Act.