Canadian Tire Corporation, Limited

Summary

Canadian Tire experienced a data breach that exposed an e‑commerce database containing basic personal information for customers of its retail brands. The compromised data included names, email addresses, dates of birth, encrypted passwords and, for a subset, incomplete credit card numbers such as card type, expiry and masked numbers. Fewer than 150 000 accounts had date of birth details leaked, and the company stated that the password and credit card information could not be used to access accounts or conduct fraudulent transactions, with no bank or loyalty data affected. Have I Been Pwned later added the breach to its database, reporting roughly 42 million records, including 38.3 million email addresses, along with addresses, phone numbers and gender information, noting that passwords were stored as PBKDF2 hashes. Affected individuals were notified by email, though the firm has not publicly confirmed the total number of victims.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On October 2 2025 Canadian Tire announced that it had discovered unauthorized access to an e‑commerce database containing information for customers who hold accounts with Canadian Tire, SportChek, Mark’s/L’Équipeur and Party City. The breach was identified on that date and the company disclosed that the compromised database held basic personal details such as names, email addresses, dates of birth, encrypted passwords and, in a subset of records, incomplete credit card numbers. Canadian Tire specified that fewer than 150 000 of the affected accounts included date of birth information and emphasized that the password and credit card data could not be used to gain access to user accounts or to carry out fraudulent transactions. The retailer also stated that no data from Canadian Tire Bank or the Triangle Rewards loyalty program was exposed in the incident.

Following the initial disclosure, the data set associated with the breach was added to the Have I Been Pwned notification service, which reported that roughly 42 million records were compromised in the attack, including approximately 38.3 million email addresses. Have I Been Pwned noted that the leaked information went beyond the details shared by Canadian Tire and also contained addresses, phone numbers and gender data for affected individuals. The service indicated that passwords were stored as PBKDF2 hashes and that for a subset of the records dates of birth and partial credit card specifics—card type, expiry date and masked card number—were also present in the exposed data. Canadian Tire confirmed that it had notified the affected individuals via email but had not yet released a public figure for the total number of victims impacted by the breach.

The company’s response included advising customers that the encrypted passwords and incomplete credit card details could not be exploited for account takeover or fraudulent purchases, and it reiterated that the breach did not involve any financial or loyalty program data. Canadian Tire maintained that the incident was limited to the e‑commerce database and that no further systems were compromised. The organization continued to monitor the situation and cooperated with relevant authorities while awaiting additional clarification on the scope of the exposure. The notification to users via email represented the primary communication effort undertaken by the retailer in the aftermath of the discovery.

Sources

Sources available to members: 1 source.