Toys R Us Canada Customer Data Breach and Online Leak

Toys R Us Canada notified customers that attackers accessed their customer database, stole personal information, and subsequently posted the data online. The breach was discovered on July 30, 2025, after threat actors claimed to have published the stolen data on the unindexed internet. The compromised information includes names, addresses, phone numbers, and email addresses, but does not include passwords, credit card details, or other highly confidential data. The company engaged third-party cybersecurity experts to investigate and contain the incident and is in the process of reporting the breach to Canadian privacy authorities.

Customers have been advised to remain vigilant against phishing attempts and unsolicited communications that may impersonate Toys R Us. While the company has upgraded its IT security systems following the breach, it has not offered free identity or fraud monitoring services to affected individuals. The total number of impacted customers has not been disclosed, but the incident highlights the risks of identity fraud, phishing, and other malicious activities that can result from the exposure of personal information online.