Canadian Tire Breach Affected More Than 38 Million Accounts
Summary
Canadian Tire said an October 2025 breach exposed customer information in an e-commerce database. Have I Been Pwned later listed about 42 million records, including 38.3 million email addresses; the company has not publicly confirmed the victim count.
Key points
- Canadian Tire said it discovered unauthorized access to an e-commerce database on October 2, 2025.
- The company said affected data included names, email addresses, encrypted passwords and, in some cases, incomplete credit card numbers; fewer than 150,000 accounts included dates of birth.
- Have I Been Pwned listed about 42 million records associated with the incident, including 38.3 million email addresses.
- The listed data also reportedly included addresses, phone numbers and gender information; passwords were stored as PBKDF2 hashes.
- Canadian Tire said the password and card information could not be used to access accounts or make fraudulent transactions, and that bank and loyalty data were not compromised.
- The company notified affected individuals by email but had not publicly confirmed the number of victims.
Article Details
- Victim Organization
- Canadian Tire
- Incident Type
- Unauthorized access to an e-commerce database resulting in a data breach
- Data Types Exposed
- Names
- Email addresses
- Dates of birth (fewer than 150,000 accounts, according to Canadian Tire)
- Encrypted passwords stored as PBKDF2 hashes
- Incomplete credit card details, including card type, expiry, and masked card number (for some records)
- Addresses, phone numbers, and gender information (reported by Have I Been Pwned)
- Affected Records
- Canadian Tire described more than 38 million affected accounts; Have I Been Pwned reported roughly 42 million compromised records, including 38.3 million email addresses. Canadian Tire had not publicly confirmed the number of victims.
- Operational Impact
- Unauthorized access to the e-commerce database and exposure of customer information; no operational disruption was reported.
- Claim Status
- confirmed