Canadian Tire canadiantire.ca Canadian Tire data breach: what happened and what to do
Canadian Tire detected a breach of an e-commerce database on 2 October 2025. Have I Been Pwned lists 38,306,562 emails with names, phone numbers, addresses and password hashes, plus birth dates and partial card data for some. The company says bank and loyalty data weren't affected.
View all 13,115 breaches- Breach date
- 2 Oct 2025
- Made public
- 14 Oct 2025
- Affected
- 38,306,562
- Data exposed
- Dates of birth, Email addresses, Genders, Names, Partial credit card data, Passwords, Phone numbers, Physical addresses
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
Canadian Tire is one of Canada's largest retailers, and its October 2025 breach touched online customers of several of its brands. It's a large one by email count, and the most useful details come from the company's own notice.
What happened
According to the company's advisory, Canadian Tire detected the incident on 2 October 2025. It involved a database holding e-commerce account details for Canadian Tire, SportChek, Mark's and Party City customers. The company said the matter had been resolved, that it had reported it to privacy regulators, and that it would contact affected account holders directly and offer credit monitoring.
Have I Been Pwned later added the data, describing a breach that exposed almost 42 million records, with 38,306,562 unique email addresses. It added the entry on 25 February 2026.
What was exposed
The records held email addresses, names, phone numbers and physical addresses. Have I Been Pwned says passwords were stored as PBKDF2 hashes. Hashing scrambles the password so it isn't readable, and PBKDF2 is designed to make guessing slow. For a subset of records, the data also held dates of birth and partial credit card data: the card type, expiry date and a masked card number.
The company said the incident did not affect bank account information or its loyalty program data. Its notice also said the partial card numbers and encrypted passwords can't be used for logins or purchases.
Even so, the combination is the kind scammers like. A name, phone number, address and email together make a believable "order problem" call or text. A date of birth, where it was included, doesn't change and helps with identity checks.
What Canadian Tire did
Canadian Tire reported the incident to regulators and said it would notify customers whose accounts were affected and offer credit monitoring. Reports said some customers received TransUnion based monitoring. If you got no notice, the company's guidance was that no further action was needed from you, but check the notice page for current instructions.
What to do
Change your Canadian Tire password if you haven't, and change any other account where you used it. Be careful with emails and texts that mention an order, a refund or a card, because the data gives scammers the details to make those messages sound real. If you did get a credit monitoring offer, taking it costs nothing.
A note on the numbers
Two figures circulate. The company's advisory talks about the accounts in one e-commerce database, and Have I Been Pwned describes almost 42 million records holding 38,306,562 unique email addresses. Both describe the same incident. One person with several accounts or several brands can appear more than once in the raw records, which is why the email count is lower than the record count.
What to do if you were in it
- 1
Change your password and any copies of it
Use a long unique password on your Canadian Tire, SportChek, Mark's and Party City accounts if you have them, and anywhere else you used the same one.
- 2
Watch for fake order, refund and card messages
Names, phone numbers and addresses were exposed. Don't act on a message that cites an order or card, and go to the retailer's site directly.
- 3
Take the credit monitoring if you were offered it
If Canadian Tire contacted you with a monitoring offer, use it and keep the notice. Review your statements for charges you don't recognise.
- 4
Think about a credit freeze
If your date of birth was in the data, a free freeze at Equifax and TransUnion Canada stops new credit being opened in your name.
- 5
Check which breaches include your email
Run a free Serus scan to see whether your email or phone number appears in this and other breaches.
Frequently asked
Was I affected by the Canadian Tire breach?
If you had an online account with Canadian Tire, SportChek, Mark's or Party City, possibly. Have I Been Pwned lists 38,306,562 email addresses, and the company said it would contact affected customers.
What was exposed in the Canadian Tire breach?
Email addresses, names, phone numbers and physical addresses, with password hashes, and for some records dates of birth and partial card data.
Were my bank details or Triangle Rewards stolen?
Canadian Tire said bank account information and loyalty program data were not affected.
Should I change my password?
Yes. Passwords were stored as hashes, but changing yours and any reused copies is the safe step.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
