PC Plus rewards collectors warned about passwords after security breach

Loblaw is warning PC Plus rewards collectors to beef up their passwords after points were stolen from some members' accounts.

"We are treating this as a breach as individual member accounts were accessed and points were stolen," said Kevin Groh, the company's vice-president of corporate affairs and communication, in a statement.

The breach stems from people using favourite or weak username and password combinations across multiple sites, he said.

These combinations were stolen from other sites and used to access PC Plus accounts, according to Groh.

In an email to PC Plus members sent late last month, Loblaw (TSX:L) pointed to sites like Yahoo and LinkedIn, which were both hacked in recent years.

Last year, LinkedIn said a 2012 security breach compromised more than 100 million user passwords. It was previously believed only 6.5 million passwords were implicated.

Also last year, Yahoo said the personal information of more than one billion of its users was stolen during a 2013 breach.

Loblaw said the company is unable to disclose how many accounts lost points as the company is continuing to work with any members whose points were taken to reinstate them.

The company emailed all PC Plus members late last month, urging them to update their passwords. It asked members to create unique passwords that are a combination of letters, numbers and characters, and to change them frequently.

Loblaw also notified law enforcement, Groh said.

Groh said Loblaw's IT security team is monitoring unusual activity and is investigating any possibility of underlying IT vulnerabilities.

With files from the Associated Press