Canadian Tire E-commerce Database Breach Exposes Data for Over 38 Million Accounts

Canadian Tire Corporation disclosed a major breach of its e-commerce customer database after identifying unauthorized access on October 2, 2025, exposing personal data tied to 38+ million customer accounts. Exposed data included names, physical addresses, email addresses, year of birth (and for <150,000 accounts, full dates of birth), and encrypted passwords; some records also contained truncated payment card numbers. The company stated the exposed financial data could not be used to conduct transactions, and reported no impact to in-store systems, Canadian Tire Bank, or Triangle Rewards.

Canadian Tire reported it remediated the underlying issue, notified regulators, and planned customer notifications and credit monitoring. Have I Been Pwned added the incident to its corpus, reporting roughly 42 million records (including ~38.3 million email addresses) and indicating the dataset includes PBKDF2 password hashes along with additional fields such as phone numbers and gender, increasing the likelihood of credential-stuffing and identity-fraud follow-on activity.