Canadian Tire, one of Canada's largest retail chains, suffered a data breach in October 2025 after an attacker gained unauthorized access to an e-commerce database through a misconfiguration. The breach affected customer accounts across four banners: Canadian Tire, SportChek, Mark's, and Party City Canada. The company detected the intrusion on October 2 and disclosed it publicly on October 14. A cybercriminal later listed the stolen database for sale on a hacking forum, asking $100,000 USD. Approximately 38.3 million records were exposed in total. The breach exposed names, email addresses, phone numbers, physical addresses, and passwords stored in an encrypted format known as PBKDF2 hashing. For a smaller subset of roughly 150,000 accounts, dates of birth and partial credit card data were also included. That partial card data consisted of card type, expiry date, and masked card number only. Canadian Tire stated that neither the partial card data nor the encrypted passwords could be used directly for transactions or account access. However, the combination of personal details across millions of records creates real risk. Attackers can use this kind of data to craft targeted phishing emails, impersonate customers, or attempt credential stuffing attacks against other accounts where people reuse passwords. Canadian Tire reported the breach to applicable Canadian privacy regulators and partnered with TransUnion Canada to notify customers whose records contained more sensitive data. Those individuals were offered credit monitoring services. No litigation or regulatory enforcement action had been publicly documented as of early 2026. Affected individuals should treat any email claiming to be from Canadian Tire or its banners with caution, change passwords used across any related accounts, and monitor their credit reports for unusual activity.

Multi-category retailers collect customer identity data, emails, phone numbers, addresses, purchase records, and loyalty program data across retail and automotive services.

Canadian Tire has maintained its position as a dominant Canadian retail brand across multiple product categories. The company has invested in digital retail infrastructure and its loyalty ecosystem. The October 2025 breach represented the most significant cybersecurity event in the company's recent history and one of the largest retail data breaches in Canadian history by affected account count.