Canadian Tire Data Breach Impacts 150,000 Online Accounts Across Retail Brands

Canada’s trusted retailer faces its latest cybersecurity test head-on.

Canadian Tire Corporation (CTC) has confirmed a data breach involving an e-commerce customer database linked to its retail websites. The incident, detected on October 2, 2025, affected customers with online accounts across Canadian Tire, SportChek, Mark’s/L’Équipeur, and Party City.

According to the official company statement, the affected database contained basic personal information only and did not include data from Canadian Tire Bank or Triangle Rewards.

What Happened

Canadian Tire reported that the unauthorized activity was isolated to a single e-commerce database. After detecting the intrusion, the company resolved the vulnerability, secured its systems, and engaged external cybersecurity experts for further analysis and monitoring. The retailer emphasized that in-store transactions were not impacted and all its online platforms remain operational.

Per a detailed analysis by Bluefire RedTeam, the breach occurred through the customer database associated with multiple banners. It was contained quickly, with no evidence of persistent access or compromise beyond that environment.

Data Affected

The compromised data set included:

• Customer name, address, email, and year of birth

• Encrypted (hashed) passwords

• Truncated (partial) credit card numbers, similar to receipt details

• For fewer than 150,000 accounts, full date of birth information

CTC confirmed that none of the exposed data can be used for account logins or purchases. No CVV codes, complete credit card details, or banking information were part of the breach.

In line with federal privacy obligations, the company has reported the incident to Canadian privacy regulators under PIPEDA and provincial laws and has begun notifying affected individuals.

Customers whose full date of birth was involved will receive direct outreach with complimentary credit monitoring through TransUnion Canada.

Company and Expert Response

“Our cybersecurity teams acted swiftly to contain and remediate the incident,” a CTC spokesperson said. “We take the protection of our customers’ information seriously and have implemented enhanced security measures across our systems.”

Cyber analysts note that while the financial risk is low, customers may still face credential phishing or social engineering attempts in the aftermath. CBC News and Global News reported that encrypted passwords and partial credit card data were confirmed to be secure and not usable for purchases.

Cybersecurity professionals recommend that customers:

• Update account passwords and avoid reuse

• Enable multi-factor authentication (MFA) wherever possible

• Monitor financial statements for unusual activity

• Stay alert for phishing emails imitating CTC or its retail brands

Continuing Investigation and Next Steps

CTC said both internal and external cybersecurity partners are actively monitoring all websites, and that there is “no indication of ongoing unauthorized activity.”

The incident serves as another reminder of the heightened cybersecurity threats facing Canadian retail and e-commerce. Experts emphasize the importance of data segmentation, tokenization, and continuous vulnerability testing as industry best practices to minimize breach exposure.

For ongoing updates and individual account guidance, customers can visit CTC’s cyber incident page.