Loblaw advises PC Plus points members to change passwords after hack

Loblaw is warning PC Plus rewards collectors to beef up their passwords after points were stolen from some members' accounts.

"We are treating this as a breach as individual member accounts were accessed and points were stolen," said Kevin Groh, the company's vice-president of corporate affairs and communication, in a statement.

Meanwhile, Global News reported that Canadian Tire shut down customer access to online accounts this week in the interests of protecting their personal information.

• Home Depot admits 56 million cards hit by security breach

"We recently noticed unusual traffic on our website and suspended customer sign-in capabilities while we investigate," communications manager Stephanie Nadalin told Global, which said it had been alerted to the problem by an unnamed Canadian Tire customer.

Those trying to access their points and credit card information on their computers instead saw a message saying that the sign-in option was "temporarily unavailable" and the company was working on the problem.

Groh said the Loblaw breach stems from people using favourite or weak username and password combinations across multiple sites.

These combinations were stolen from other sites and used to access PC Plus accounts, according to Groh.

In an email to PC Plus members sent late last month, Loblaw pointed to sites like Yahoo and LinkedIn, which were both hacked in recent years.

Last year, LinkedIn said a 2012 security breach compromised more than 100 million user passwords. It was previously believed only 6.5 million passwords were implicated.

Also last year, Yahoo said the personal information of more than one billion of its users was stolen during a 2013 breach.

• Target data breach may affect some Canadians

Loblaw said the company is unable to disclose how many accounts lost points as the company is continuing to work with any members whose points were taken to reinstate them.

The company emailed all PC Plus members late last month, urging them to update their passwords. It asked members to create unique passwords that are a combination of letters, numbers and characters, and to change them frequently.

Loblaw also notified law enforcement, Groh said.

Groh said Loblaw's IT security team is monitoring unusual activity and is investigating any possibility of underlying IT vulnerabilities.