Loblaw

An unauthorized party was inside Loblaw technology systems from as early as February 23, 2026, reaching names, addresses, birthdates, loyalty numbers, purchase details, and partial card data for about two million shoppers, by CBC's count. The notice never says how they got in. The forced logout across PC Optimum and every other PCiD app exposed the design: one shared identity layer, one shared failure domain. Two years of credit monitoring does not unshare an identity.