A data breach at Canadian Tire exposed personal data from over 38 million accounts in October 2025, making it one of the largest retail breaches in Canada. On 2 October 2025, Canadian Tire Corporation identified a data breach involving customer information in an e-commerce database, with no impact on in-store transactions.
The exposed data included names, addresses, emails, year of birth, encrypted passwords, and in some cases, truncated credit card numbers; less than 150,000 accounts also included full dates of birth. The breach did not affect Canadian Tire Bank or Triangle Rewards, and Canadian Tire said it identified and fixed the issue and would notify regulators and affected users.
Have I Been Pwned added the compromised records to its database, and according to Have I Been Pwned, about 42 million records were exposed, including 38.3 million email addresses.