Loblaw’s October breach update now has a public set of commitments attached to it. That gives customers and regulators something more specific to check than a general promise that security has improved.
On October 26, the Office of the Privacy Commissioner of Canada announced voluntary commitments following a cyberattack affecting approximately two million Canadians. The regulator says its investigation remains open until it is satisfied the company has fulfilled them. An agreement to take action is therefore not the same as confirmation that every action is complete.
Read the March and October notices in sequence
Loblaw’s March 10 announcement described unauthorized access to basic customer information, including names, phone numbers and email addresses. It said its investigation at that time indicated passwords, health information and payment-card data were not compromised.
The company’s October update gives a broader list of potentially affected information: dates of birth, loyalty account numbers, purchase-order details and incomplete payment-card information, among other fields. It says the information varied by customer and not every category applied to everyone.
Do not use the March description as a complete account of an individual’s exposure after the later update. Equally, the later list does not establish that full card numbers or every listed field were involved for every customer. The individual notice is the document to examine for that person’s reported categories.
The letter provides deadlines
The compliance letter was signed October 21 and published by the OPC on October 26. Its commitments include:
| Deadline | Commitment to the commissioner |
|---|---|
| November 16, 2026 | Confirm all affected individuals have been notified as required. |
| January 31, 2027 | Describe the data-review, validation and de-duplication process and the method used to assess significant-harm risk. |
| October 31, 2027 | Provide an independent external security assessment from a firm approved by the OPC. |
| November 30, 2027 | Explain how assessment recommendations have been addressed or why alternatives are proposed. |
These are commitments and review dates, not findings that a particular system is secure today. A useful follow-up would ask whether the required information was supplied and what the commissioner concluded after reviewing it.
A compliance letter is not a finding of wrongdoing
The letter expressly says it is not an admission of liability, fault or wrongdoing, or a finding that Loblaw contravened PIPEDA. It preserves the commissioner’s powers and permits continued investigation if commitments are not fulfilled or new concerns arise.
That is why this development should not be described as a fine, a court judgment or an investigation already closed. The regulator’s announcement describes an effort to secure improvements through voluntary compliance while keeping the inquiry open.
What a notification should help you understand
The OPC’s general breach guidance distinguishes reporting a breach to the commissioner from notifying affected people. For organizations covered by PIPEDA, both are required when the relevant real-risk-of-significant-harm threshold is met; records of all breaches must also be kept.
The guidance says a notification should describe the incident and affected information and explain steps individuals can take to reduce harm. Those are useful questions to apply to a notice you receive. Does it identify your reported data categories? Does it explain the support available and give an independently verifiable contact route?
Loblaw’s current account notice says it is contacting relevant people through Cyberscout, a TransUnion division, and offering monitoring and identity-protection services where appropriate. Verify an unexpected message through the company’s official published information before following instructions or providing more data.
Keep the notice and the date received. If its description is unclear, ask for clarification about the specific information involved.