Canadian Tire Confirms Major Data Breach: 150,000 Customers Affected

Canadian Tire has disclosed a data breach affecting its online shopping database, exposing customer information tied to Canadian Tire, SportChek, Mark’s/L’Équipeur, and Party City accounts.

The company said on October 14 the breach was detected on October 2, 2025, when it found “unauthorized activity” in an e-commerce database. According to Canadian Tire, the hack was limited to that system and did not impact Canadian Tire Bank or Triangle Rewards data.

The exposed data includes names, addresses, emails, and years of birth, along with encrypted passwords and partial credit card numbers — the kind that appear on a store receipt. The retailer says the partial credit card info and encrypted passwords cannot be used to log into accounts or make purchases.

For about 150,000 customers, the database also contained full dates of birth. Those individuals will receive an email from TransUnion on behalf of Canadian Tire in the coming days, offering credit monitoring. The company says it has notified privacy regulators and hired outside cybersecurity experts to review its systems.

All affected websites are said to be secure, and Canadian Tire claims the vulnerability was “resolved quickly.” It also insists no further unauthorized activity has been detected.

Customers do not need to change passwords or replace credit cards, the company says, though it still recommends using strong, unique passwords and enabling two-factor authentication. Password managers such as 1Password can be your best friend.

Canadian Tire’s FAQ page reassures customers that “there is no indication of any ongoing unauthorized activity.” However, the company’s statement ends with the familiar corporate disclaimer — that cyberattacks are rising globally and “no organization is completely immune” (an attempt to deflect and gaslight consumers of course).