Canadian Tire Corporation (CTC) identified a significant data breach affecting an e-commerce database, which has since been linked to approximately 38.3 million unique accounts.

Key Breach Details

• Affected Platforms: The breach involved customers who had online accounts with Canadian Tire, SportChek, Mark’s/L’Équipeur, and Party City.
• Exposed Information: Compromised data included names, physical addresses, email addresses, phone numbers, and birth years.
• Sensitive Data: Passwords (stored as PBKDF2 hashes) and incomplete credit card information (similar to store receipts, such as card type and expiry) were also exposed but are not sufficient for unauthorized transactions.
• High-Risk Subset: Fewer than 150,000 account holders had more detailed information exposed, including their full dates of birth.
• Unimpacted Systems: The incident did not affect Canadian Tire Bank information or Triangle Rewards loyalty program data.

Response & Remediation

• Security Fix: The company stated the vulnerability was identified and resolved by October 2, 2025.
• Customer Notification: CTC is notifying impacted individuals directly. Those whose sensitive data (like full birth dates) was involved are receiving one year of free credit monitoring via TransUnion Canada.
• Official Guidance: If you have not received an email from [email protected] or a physical letter, CTC indicates no specific action is required, though changing passwords remains a recommended practice.