Key takeaways
- On October 26, 2026, the OPC announced Loblaw Companies signed a compliance letter on October 21 over a February 2026 cyberattack that affected about two million Canadians, committing to an external assessment of its strengthened security measures and to reporting back on further recommendations.
- The Commissioner’s investigation stays open until he is satisfied Loblaw met every commitment, a different ending from WestJet’s compliance letter, which closed its investigation on October 14.
- Loblaw’s own account of what was taken widened between March and October, from basic contact details to dates of birth, loyalty account numbers, purchase order details, and incomplete payment card information, which is why the notification sequence matters as much as the fix.
The letter, and the sentence that matters most
The OPC announced the letter on October 26, 2026, out of Gatineau. Loblaw signed it on October 21. The commitments are specific. Loblaw will bring in an external security firm to assess whether the strengthened measures actually work, and will tell the Commissioner how it will act on whatever else that firm recommends.
Then comes the sentence that separates this file from the last one. The Commissioner’s investigation will remain open until he is satisfied Loblaw fulfilled all its commitments. A compliance letter is a voluntary route, not a penalty and not a finding. The release gives no date and no public test for what “satisfied” will look like. That is the thread to watch.
Rewind: February to October
The attack itself dates to February 2026, when a hacking group got into Loblaw systems and customer account information. In March, Loblaw contained the incident with an outside cybersecurity firm, posted a public notice on its website and an in-app message for PC Optimum users, and notified the OPC. Customers first noticed it as a forced logout from the PC Optimum app.
What Loblaw said was taken changed as the investigation went on. The March notice described basic customer contact information. The October 2 update listed names, addresses, phone numbers, email addresses, dates of birth, loyalty account numbers, certain purchase order details, and incomplete payment card information, with the caveat that the mix varied by customer. Direct notification to affected individuals began in the weeks after that update, and Loblaw is offering complimentary credit monitoring and identity restoration through TransUnion.
I have seen this widening pattern before, and it is the part of a breach file that does the most damage to trust. The first notice is written when the team knows the least. Every revision after it reads like a correction, even when it is just the investigation catching up. The fix is boring and it works: scope the first notice to what is confirmed, say plainly that the list may grow, and give a date for the next update.
Two letters, two endings
Twelve days earlier, the OPC closed its WestJet file. Same instrument, different outcome.
| WestJet | Loblaw | |
|---|---|---|
| Breach | Cyberattack disclosed in 2026, more than five million customers and employees affected | February 2026 cyberattack, about two million Canadians affected |
| Compliance letter signed | July 2026 | October 21, 2026 |
| OPC announcement | October 14, 2026: satisfied, investigation closed | October 26, 2026: commitments announced, investigation open |
| What the company committed to | MFA, identity and access controls, security awareness, independent security assessment | External firm to assess strengthened measures, report back on further recommendations |
| What ends the file | Commitments met, announced publicly | Commissioner satisfied, no date given |
WestJet is the template for how a compliance letter closes. Loblaw is the live test of how long one stays open, and whether the external assessment’s findings ever surface in public. The OPC describes voluntary compliance letters as efficient resolution with motivated companies. That framing cuts both ways. Efficient for the regulator and the company, but the public learns the outcome only when the Commissioner decides he is satisfied.
What to take from the pair
Read the letter itself rather than the headline. A compliance letter announcement tells you what a company promised, not what it proved. WestJet’s closure notice is the proof event. Loblaw has not had one yet, so any vendor or partner questionnaire that treats the October 26 announcement as resolution is jumping the gun.
Put the assessment clause in your own incident playbook. Loblaw’s commitment is a useful model: an outside firm checks the fix, and the report goes to the regulator with a response plan. If your breach response ends at “we contained it and hardened systems,” you have no independent check and no paper trail for the next questionnaire.
Sequence notifications like the scope will grow. Loblaw’s March to October widening is normal for a real investigation, and it still reads badly. Promise the next update in the first notice, and keep the promise even if the update is “no change yet.”
Actionable takeaway: If Loblaw sits anywhere in your third-party inventory, update its file this week: incident open, compliance letter signed October 21, 2026, external assessment pending, OPC file open with no closure date. Re-check the file when the OPC announces satisfaction, and treat any claim of closure before that announcement as unverified.