CANADIAN Tire has confirmed that more than 38 million accounts were affected by an October 2025 data breach targeting its e-commerce platforms, with the incident discovered on 2 October 2025. The breach involved unauthorized access to an e-commerce database, exposing basic personal information for customers with online accounts across Canadian Tire, SportChek, Mark’s/L’Équipeur and Party City.
Compromised data included names, email addresses, dates of birth, encrypted passwords, and in some cases incomplete credit card numbers, while fewer than 150,000 accounts had date of birth details exposed. Passwords were stored as PBKDF2 hashes, and in a subset of records dates of birth and partial credit card data (card type, expiry and masked number) were also present.
According to Have I Been Pwned, roughly 42 million records were compromised in the attack, including 38.3 million email addresses, and the leaked data also includes addresses, phone numbers and gender information. Canadian Tire has notified the affected individuals by email but has not publicly confirmed the total number of victims.