Canadian Tire 2025 data breach impacts 38 million users

A data breach at Canadian Tire exposed personal data from over 38 million accounts, including contact details and encrypted passwords.

More than 38 million accounts were affected by an October 2025 data breach at Canadian retail giant Canadian Tire (CTC). The incident marks one of the largest retail data breaches in Canada, raising concerns about customer privacy and the security of sensitive personal information.

“On October 2, 2025, Canadian Tire Corporation (TSX: CTC) (TSX: CTC.A) (CTC or the Company) identified a data breach involving customer information in an e-commerce database.” reads the press release published by CTC. “There was no impact on in-store transactions, and all e-commerce systems are operational.”

On October 2, 2025, the company discovered a data breach affecting its e-commerce database. The incident exposed basic customer details, including names, addresses, emails, year of birth, encrypted passwords, and in some cases, truncated credit card numbers.

The company pointed out that exposed financial data cannot be used to access accounts, make transactions, or make purchases.

Less than 150,000 accounts also included full dates of birth. The breach did not impact Canadian Tire Bank, Triangle Rewards, or in-store systems. The company identified and fixed the issue and notified regulators.

The Canadian firm will contact affected users and will offer them credit monitoring.

The data breach notification service Have I Been Pwned added the compromised records to its database. According to the platform, about 42 million records were exposed, including 38.3 million email addresses.

HIBP states that compromised data includes:

• Dates of birth
• Email addresses
• Genders
• Names
• Partial credit card data
• Passwords
• Phone numbers
• Physical addresses

HIBP reports that the datasets include PBKDF2 password hashes.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CTC)