Weekly briefing › No. 42
Weekly briefing · No. 42 · 30 Oct 2026
This week's events touched healthcare, retail, education, local government technology and the legal sector in Canada and the United States.
Quest Diagnostics confirmed unauthorized access to patient records. Loblaw agreed to strengthen its security measures after a breach that affected approximately two million Canadians.
This issue’s disclosures
CriticalOct 23
Quest Diagnostics
Healthcare · Unknown records
Quest Diagnostics told U.S. regulators in an 8-K filing that it learned of a cyberattack on Wednesday targeting Quanum, a system doctors' offices and hospitals use to request lab tests and handle billing. The company said the unauthorized access included certain patient records. It has notified law enforcement and is investigating.
What it means: Sensitive patient information is involved and the number of people affected has not been stated.
Oct 23
HighOct 30
Organisation not named
Infrastructure · Unknown records
The disclosure as indexed does not name the organisation.
Data breaches were reported at McCarthy Tétrault, Borden Ladner Gervais, Bennett Jones and Davies Ward Phillips & Vineberg. The firms say the damage has been contained and they are alerting affected parties.
What it means: Canada's largest law firms are on high alert and anyone contacted by one of these firms should read the notice carefully.
Oct 30
HighOct 26
Loblaw Companies Ltd.
Individual Identity · 2M records
In February 2026 a hacking group gained access to Loblaw's systems and customer account information. The Privacy Commissioner of Canada opened an investigation and Loblaw signed a compliance letter on October 21, 2026 agreeing to take additional measures. Loblaw has started directly notifying the individuals who were impacted.
What it means: PC Optimum users should watch for a direct notice from Loblaw and read it carefully.
Oct 26
HighUnknown
CitySourced
Infrastructure · 42M records
A researcher found a publicly exposed CitySourced database with no password protection or encryption, holding about 42 million documents. Most were images of code violation reports. Some records held a decade's worth of names, physical addresses, email addresses and phone numbers. The database has since been restricted and it is unknown how long it was accessible.
What it means: CitySourced provides services to local government in the U.S., Canada and the Caribbean, so people who reported local issues may be in the exposed records.
Unknown
Oct 26
Frontline Education
Infrastructure · Unknown records
Frontline Education began sending notification letters on October 26, 2026 about an incident involving Frontline Central and School Health Management. Its security team identified a vulnerability in a third party software product on August 14, 2026 that allowed unauthorized access. The last day of unauthorized activity was August 15 and the company says the incident has been fully remediated.
What it means: People who receive a letter should read it, as it explains what personal information was involved.
Oct 26
HighOct 17
Pattison Food Group (More Rewards, Save-On-Foods)
Individual Identity · Unknown records
Pattison Food Group, which operates the More Rewards loyalty program through Save-On-Foods, Buy-Low Foods, PriceSmart Foods and Nesters stores, said customer data was accessed in a cybersecurity breach. Some B.C. grocery store customers are being warned they may be victims.
What it means: More Rewards members in B.C. should look out for communication from the company about the incident.
Oct 17
This issue by category
Where this issue’s disclosures sit.
The 6 disclosures in issue No. 42, by the category we filed each one under.