Loblaws

Loblaws, operating as Loblaw Companies Limited (LCL), is a Canadian organization primarily engaged in retail grocery services through its chain stores and affiliated digital platforms. The company manages customer accounts across its websites, including loyalty programs such as PC Plus, which allows users to accumulate and redeem points for purchases. Its operations focus on the Canadian market, providing grocery retail services alongside integrated online account management features that facilitate personalized shopping experiences and rewards tracking. The organization’s digital infrastructure supports transactional and loyalty-related activities, reflecting its emphasis on customer engagement through both physical and digital channels.

The company has faced recurring cybersecurity challenges impacting customer account security. In February 2017, a breach compromised PC Plus rewards accounts, leading to unauthorized theft of loyalty points attributed to credential stuffing attacks exploiting weak or reused passwords from third-party platforms. Five months later, a second breach affected limited user accounts across Loblaws’ websites, though the company did not disclose specific compromised data beyond confirming fraudulent access. Both incidents prompted direct customer notifications and password reset advisories, with the earlier breach involving financial losses for users through stolen points. These events underscored vulnerabilities in authentication processes and credential management, highlighting persistent risks despite internal monitoring efforts to detect unusual activity. The organization attributed the breaches to external credential exposure while continuing to assess system security measures.