A hobbyist web developer has exposed a major security flaw on the Canada Computers website that may have sent customer credit card details to hackers for over a month.
Canada Computers & Electronics is a tech retailer headquartered in Richmond Hill, Ontario. The chain operates about 38 stores across British Columbia, Nova Scotia, Ontario and Québec.
The issue came to light when a shopper noticed a suspicious “card skimmer” script while making a purchase on January 18. This malware, often called a Magecart attack, was designed to steal everything typed into the payment form, including credit card numbers, CVV codes, and full billing addresses.
The shopper attempted to alert the company twice through support tickets, but both were closed without a response. It was only after the findings were posted publicly on Reddit that the malicious code was removed from the checkout page.
Archived records suggest the skimmer may have been active since at least late December. On Sunday night (early morning Monday EST), Canada Computers began emailing affected customers to admit to the security failure.
“We are writing to tell you about a data security incident that may have exposed certain of your personal information to an unauthorized intruder,” the company stated in the notice.
The retailer confirmed that “an unauthorized user may have gained access to certain customer information, including email addresses, first and last names and possibly credit card numbers.”
While the company says it does not have “any evidence that this information has been used fraudulently,” they are now urging customers to monitor their bank statements and change their passwords.
“Our systems have been thoroughly vetted and further enhancement to our security systems have been implemented,” Canada Computers said, adding that “our systems were put through vigorous testing by our IT team to ensure there are no current vulnerabilities.”
The full statement sent out just after midnight PST (January 26 EST) by Canada Computers can be found below:
We are writing to tell you about a data security incident that may have exposed certain of your personal information to an unauthorized intruder.
What Happened and What Information was Involved
On Friday, January 23, 2026, we discovered that there had been unauthorized access to portion of our system, which may have compromised the security of a few of our online customers’ information. We believe that an unauthorized user may have gained access to certain customer information, including email addresses, first and last names and possibly credit card numbers. We do not have any evidence that this information has been used fraudulently.
What We Are Doing to Protect You
Our systems have been thoroughly vetted and further enhancement to our security systems have been implemented. Our systems were put through vigorous testing by our IT team to ensure there are no current vulnerabilities.
What You Can Do
We strongly encourage you to be vigilant in protecting your personal information by changing all of your website and computer passwords and check your bank and credit card statements to see if there have been any unusual or unauthorized transactions or activity. You may also wish to contact your bank or credit card company to cancel your card and request a new one.
Please rest assured that our customers’ well-being and the security of their personal information are our highest priorities. We apologize for any inconvenience this incident may cause you and thank you for your understanding and patience.
For More Information
If you have any questions or need additional information about this notice, please contact us at Cu**************@*************rs.com.
Sincerely,
Canada Computers
Security experts recommend that anyone who bought items from the Canada Computers online store between early December and January 22 should consider freezing or cancelling their credit cards as a precaution. If you bought anything from the Canada Computers website, you should keep a close eye on your statements and transactions from your credit cards, folks.
Want to see more of our stories on Google?
P.S. Want to keep this site truly independent? Support us by buying us a beer, treating us to a coffee, or shopping through Amazon here. Links in this post are affiliate links, so we earn a tiny commission at no charge to you. Thanks for supporting independent Canadian media!
A similar thing happened years ago, where it was discovered that credit card numbers were being stored in plain text accessible to the internet.
No one should ever be shopping at this company.
bruh, at least you can do is offer equifax for 5 years
…or 25% off RAM kits. 😉 Iykyk 😎👍🏻
The fact that they ignored the report until it was made public is mind blowing. I won't say I hope they go under, as competition in the sector is more necessary now than ever, but I do hope many, many people look at this and decide to shop at Memory Express instead.
They've been a pretty disreputable company for a decade. None of this should surprise anyone.
That's why I prefer online stores where I can checkout using PayPal instead of giving out my credit card information.
EXACTLY! If PayPal isn't a payment option, I won't risk my personal info or $$$
I deleted my account, I encourage everyone else to do the same. You have to call their customer support, but you'll encounter no friction. It took five minutes top. Which is a good sign that they're likely handling a lot of the same requests. This used to be a great business. I think this is their hitting-the-iceberg moment rather than a wake-up call. Oh well.
Good to know Canada Computers takes its customer payment & personal info security seriously😳. 2 attempts to warn the company & they CLOSE those tickets WITHOUT responding but as soon as it's put on Social Media, THAN THEY CARE??? The LACK of effort, not really taking responsibility for their DISMAL security and making NO offers to ensure their customers info is safe just confirms they really don't. They just care that they LOOK like they do🧐. Good to know now so when I need to make some purchases in the next few months, I know exactly where NOT to go🥴