Loading story…
Canada’s National Capital Commission (NCC) disclosed that an unauthorized party accessed its website database on August 28. The potentially exposed information includes website users’ names, email addresses, mailing addresses, and telephone numbers; the NCC publicly reported the privacy breach on September 22.
The NCC said it had no evidence that the information had been misused at the time of disclosure. It advised potentially affected individuals to watch for suspicious emails, messages, or calls seeking personal information, and said it had taken steps to address the incident while reviewing its security measures.
See attribution, scope, and your downstream exposure.
2 events from the most recent confirmed update back to the earliest known activity.
The NCC disclosed the privacy breach and said it had no evidence at that time that the potentially exposed information had been used maliciously. It advised affected individuals to be alert for suspicious communications and said it had taken steps to address the incident while reviewing its security measures.
An unauthorized party accessed the National Capital Commission's website database, potentially exposing website users' names, email addresses, mailing addresses, and telephone numbers.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Canadian Tire Corporation** disclosed a major breach of its **e-commerce customer database** after identifying unauthorized access on **October 2, 2025**, exposing personal data tied to **38+ million customer accounts**. Exposed data included names, physical addresses, email addresses, year of birth (and for **<150,000** accounts, full dates of birth), and **encrypted passwords**; some records also contained **truncated payment card numbers**. The company stated the exposed financial data could not be used to conduct transactions, and reported **no impact** to in-store systems, *Canadian Tire Bank*, or *Triangle Rewards*. Canadian Tire reported it **remediated the underlying issue**, notified regulators, and planned customer notifications and **credit monitoring**. *Have I Been Pwned* added the incident to its corpus, reporting roughly **42 million records** (including **~38.3 million email addresses**) and indicating the dataset includes **PBKDF2 password hashes** along with additional fields such as phone numbers and gender, increasing the likelihood of credential-stuffing and identity-fraud follow-on activity.
Jun 29, 2026
National Public Data disclosed a security incident affecting a large repository of consumer background-check and people-search information, with exposed data reported to include highly sensitive personal identifiers such as **Social Security numbers**, names, mailing addresses, and other profile details. The company published a breach notice on its website, while an individual notification letter filed with the California Attorney General indicates affected residents were formally notified that their information may have been involved. The incident drew attention because the compromised records appear to involve data commonly used for identity verification and fraud, increasing the risk of **identity theft**, account takeover, and social-engineering abuse. The notification materials show the breach response included direct notice to impacted individuals and guidance on protective steps such as monitoring accounts and credit activity, underscoring the seriousness of the exposure for consumers whose records were held by the data broker.
Jul 12, 2026
Canada’s **Canadian Investment Regulatory Organization (CIRO)** confirmed a data breach affecting approximately **750,000 investors**, attributing the incident to a **sophisticated phishing attack** detected in **August 2025**. CIRO said it conducted an extensive forensic investigation (citing **9,000+ hours** of review by a third-party forensic firm) and determined that a limited subset of investigative, compliance, and market-surveillance data—including investor information—was **copied** from its systems; CIRO also reported that some systems were taken offline during response efforts but that critical operations were not disrupted. CIRO warned that exposed data may include **dates of birth, phone numbers, annual income, Social Insurance Numbers, government-issued ID numbers, investment account numbers, and account statements**, while stating that **login credentials were not at risk**. The organization said it has **no evidence of misuse** and has not observed related dark-web exposure to date, and it reported notifying law enforcement and relevant authorities (including privacy commissioners) while offering affected individuals **two years of credit monitoring and identity theft protection**.
Jun 29, 2026