Canadian Tire data breach (2025) — what was exposed and what to do

What happened

According to public breach records, the Canadian Tire data breach on October 2, 2025 is reported to have exposed the personal information of 38,306,562 accounts.

In October 2025, retailer Canadian Tire was the victim of a data breach that exposed almost 42M records. The data contained 38M unique email addresses along with names, phone numbers and physical addresses. Passwords were stored as PBKDF2 hashes and for a subset of records, dates of birth and partial credit card data were also included (card type, expiry and masked card number). In its disclosure notice, Canadian Tire advised that the incident did not impact bank account information or loyalty program data.

Canadian Tire discovered unauthorized access to one of its e-commerce databases on October 2, 2025, exposing personal information for roughly 38 million accounts across its Canadian Tire, SportChek, Mark's/L'Équipeur and Party City online brands. The exposed records included names, email addresses, phone numbers, physical addresses, genders, dates of birth, partial credit card numbers and hashed (PBKDF2) passwords; the company stated the password and partial credit card data could not be used to access accounts or make fraudulent transactions, and that Canadian Tire Bank, Triangle Rewards and in-store systems were not affected. The company fixed the issue, notified regulators and affected customers by email, and offered credit monitoring; the publicly reported attack vector was not specified. ["Change your Canadian Tire / SportChek / Mark's / Party City password, and reset that password anywhere else you reused it, since hashed credentials were exposed.", "Turn on two-factor authentication on the affected retail accounts and any account that shared the same password.", "Watch credit and debit statements for unfamiliar charges and ask your card issuer to flag or reissue any card whose partial number may have been exposed.", "Be alert to targeted phishing or smishing that references your name, address, birth date or recent purchases, since contact details and dates of birth were leaked."]

What data was exposed

The following types of personal data were compromised:

• Dates of birth
• Email addresses
• Genders
• Names
• Partial credit card data
• Passwords
• Phone numbers
• Physical addresses

Breach details

This summary is compiled from public breach-notification data and known leak databases. Figures reflect what those sources report and may be revised as more is learned. If something here looks wrong or you think your information is involved, contact our support team.

We report breaches as a factual record to help people check their exposure. Inclusion here is not an allegation of wrongdoing or negligence by Canadian Tire; it reflects a publicly reported security incident.

What to do now

Based on the data exposed in this breach, here are the steps you should take:

• Change your Canadian Tire / SportChek / Mark's / Party City password, and reset that password anywhere you reused it, since hashed credentials were exposed.
• Enable two-factor authentication on the affected retail accounts and any account that shared the same password.
• Monitor credit and debit statements for unfamiliar charges and ask your card issuer to flag or reissue any card whose partial number may have been exposed.
• Stay alert to targeted phishing or smishing that references your name, address, birth date or recent orders, since contact details and dates of birth were leaked.

Check your exposure

Data breaches are one of the ways your personal information ends up on data broker sites. Run a free scan to see which sites are exposing your personal data — and take action to remove it.

Sources

• Canadian Tire Data Breach Impacts 38 Million Accounts - SecurityWeek
• Have I Been Pwned: Canadian Tire Data Breach