Breach · · 3 min read
The Canadian Tire breach: 38 million accounts, and what to do now
An October 2025 breach exposed online account details for Canadian Tire, SportChek, Mark’s and Party City shoppers. What was taken, what wasn’t, and the steps worth taking.
If you’ve ever shopped online at Canadian Tire, SportChek, Mark’s/L’Équipeur or Party City, your account details were probably in the database that was breached in October 2025. Here’s what’s known, from the company and from the people who have examined the data.
What happened
Canadian Tire Corporation says it identified a breach of an e-commerce database on October 2, 2025, and announced it on October 14. The database held customer accounts for all four banners. The company says the unauthorized activity was limited to that database, that it has fixed the vulnerability, and that it reported the incident to privacy regulators.
In February 2026, the breach notification service Have I Been Pwned added the data set: almost 42 million records containing 38.3 million unique email addresses. When it was added, Have I Been Pwned noted that 86% of those addresses were already in its database from earlier breaches.
What was in it
According to Canadian Tire’s customer FAQ, the database contained:
- name, address, email and year of birth
- passwords, stored in protected (hashed) form
- in some cases, incomplete credit card numbers, like the ones printed on a store receipt
For fewer than 150,000 accounts, it also held a full date of birth. Have I Been Pwned’s analysis adds phone numbers and gender, and says the card data, where present, was the card type, expiry date and a masked number.
What it didn’t include, according to the company: Canadian Tire Bank information, Triangle Rewards loyalty data, full card numbers or the security code on the back of a card.
What it means for you
The card fragments can’t be used to make purchases, and you don’t need to replace your card. The company says the same about the passwords. Hashed passwords aren’t readable as-is, but how well a hash holds up depends on how strong the original password was. If you reused your Canadian Tire password anywhere else, that’s the part to fix.
The bigger risk is quieter. A name, email, phone number and home address together are exactly what a scammer needs to make a message look like it comes from a store you really use. We wrote about how leaked details make phishing feel personal.
What to do
- Change any reused password. If the password you used at Canadian Tire, SportChek, Mark’s or Party City is also used elsewhere, change it there first. A password manager makes unique passwords painless.
- Turn on stronger sign-in where you can, ideally a passkey.
- Treat “about the breach” messages with care. Canadian Tire says the people with full birth dates on file were contacted by TransUnion on its behalf, by email from creditmonitoring@notifications.cyberscout.com or by mail, and offered credit monitoring. If a message asks you to call a number, sign in through a link or pay anything, go to the company’s site yourself instead.
- Watch for packages and refunds you weren’t expecting. Order-related scams are an easy fit for retail data.
- If you received a notice, follow its instructions. You can also ask Equifax and TransUnion about a fraud alert on your file; see our after-a-breach checklist.
You can check whether your email address appears in this breach on Have I Been Pwned.
Sources
- Canadian Tire Corporation, Advisory: Canadian Tire Corporation E-Commerce Data Incident, October 14, 2025
- Canadian Tire Corporation, Customer Information: October 2025 Cyber Incident, as of November 8, 2025
- Have I Been Pwned, Canadian Tire Data Breach, added February 25, 2026
- SecurityWeek, Canadian Tire Data Breach Impacts 38 Million Accounts, February 28, 2026
- CyberInsider, Canadian Tire data breach impacted over 38 million people
New posts, by email.
About once a month. Plain-language privacy notes, nothing else. I never share your address.