Canadians could be part of new class-action lawsuit filed against Loblaw
Loblaw is facing a new national class-action lawsuit on behalf of millions of Canadians affected by a data breach.
On Nov. 2, Consumer Law Group filed a class-action lawsuit against Loblaw at the Ontario Superior Court of Justice due to a February data breach that exposed the private information of two million Canadians.
The grocery retail chain includes 2,500 stores under the names Loblaws, No Frills, Real Canadian Superstore, Zehrs, and Fortinos.
What’s the lawsuit about?
sockagphoto/Shutterstock
On March 10, 2026, Loblaw issued a press release stating that it was investigating a data breach. The company said it identified suspicious activity in or around February, during which “a criminal third-party” accessed customer information like names, phone numbers, email addresses, date of birth, and purchase order details. PC Financial was not affected by the breach.
Loblaw President and CEO Per Bank issued a statement saying that the company secured its network and customer information, logging all customers out of their accounts. It added that it reported the incident to privacy regulators and law enforcement. Affected customers were also offered 24 months of free credit monitoring and identity restoration services through TransUnion’s myTrueIdentity service.
The court document alleges that the company’s failure “was intentional, wilful, reckless or — at the very least — negligent” as it knew or ought to have known that its cache of customers’ personal information was “an attractive target for cybercriminals.”
The lawsuit further alleges that Loblaw did not notify affected Canadians that their personal information had been compromised until October 2026, several months after the incident. It claims the free credit monitoring service is not enough because it offers only partial coverage, is limited to two years, and doesn’t prevent the misuse of personal information.
The class action alleges that Loblaw breached several privacy laws and violated the Consumer Protection Act.
Daily Hive has reached out to Loblaw for comment and will update this story when it receives a response.
Who’s eligible?
JHVEPhoto/Shutterstock
You could be eligible to file a claim if you’re a Canadian resident whose personal information was compromised in the February 2026 data breach, and weren’t notified until October 2026.
How much could you get?
The amount hasn’t been specified yet, but the proposed lawsuit is seeking damages on behalf of eligible Canadians.
What should you do next?
For now, you don’t have to do anything, as the lawsuit still hasn’t been certified. However, you can keep up with the latest updates by signing up online.