Yes, the Canadian Tire data-breach report is real—but “38 million accounts” needs qualification. Canadian Tire detected unauthorized access to an e-commerce database on October 2, 2025. The database served online accounts associated with Canadian Tire, SportChek, Mark’s/L’Équipeur and Party City.
Have I Been Pwned (HIBP) later listed almost 42 million records, including 38.3 million unique email addresses. That does not mean 42 million people were affected or that every person had every listed data field exposed. Canadian Tire said the incident did not include Canadian Tire Bank information, Triangle Rewards data, full card numbers or CVVs.
As an Amazon Associate I earn from qualifying purchases.
What happened in the Canadian Tire breach?
Canadian Tire said it discovered unauthorized activity involving a specific e-commerce database on October 2, 2025. The company publicly disclosed the incident on October 14, 2025, and said the vulnerability had been resolved.
Recommended Free Tools
The affected database supported online accounts for:
#1 Best Overall
- Canadian Tire
- SportChek
- Mark’s/L’Équipeur
- Party City
According to Canadian Tire’s incident information, e-commerce systems remained operational and in-store transactions were not affected. The company also said it engaged external experts to investigate and assist with its response.
The reviewed public sources do not establish the attack method, threat actor, initial vulnerability or whether a particular criminal group published or sold the data.
Why are reports using different numbers?
The figures refer to different measurements:
| Measure | Figure | What it means |
|---|---|---|
| Reported affected accounts | More than 38 million | The headline figure reported by SecurityWeek |
| Unique email addresses | 38.3 million | HIBP’s count of distinct email addresses in its dataset |
| Total records | Almost 42 million | HIBP’s broader record count |
Have I Been Pwned lists almost 42 million records and approximately 38.3 million unique email addresses. SecurityWeek reported that more than 38 million accounts were affected.
These are not interchangeable terms. A record is not necessarily a distinct person, and an email address may appear in more than one record. The database may also have included multiple accounts, historical information or duplicate entries across four retail brands, but the exact reason for the difference has not been publicly established. It is therefore inaccurate to call this “38 million Canadians” or “42 million victims.”
What information was exposed?
Canadian Tire’s official description
Canadian Tire said the database contained:
- Names
- Postal addresses
- Email addresses
- Year of birth
- Encrypted passwords
- Incomplete or truncated credit-card numbers in some cases
Fewer than 150,000 accounts contained date-of-birth information, according to the company’s October 14 disclosure.
What the later HIBP listing reports
HIBP’s listing additionally identifies email addresses, names, physical addresses, phone numbers, gender information, dates of birth for a subset, partial card information and passwords stored as PBKDF2 hashes.
That information should be attributed to HIBP rather than treated as a replacement for Canadian Tire’s account-level notification. A positive HIBP match confirms that an email address appeared in the breach dataset; it does not show which optional fields were attached to that particular record.
Were full credit-card numbers or banking details exposed?
Canadian Tire said no. The company described the card information as incomplete or truncated, similar to information that may appear on a receipt. It said the database did not contain full card numbers or CVVs and that the partial information could not be used to make purchases.
Canadian Tire also said the affected database did not include:
- Canadian Tire Bank information
- Triangle Rewards loyalty data
This was an e-commerce-account incident, not a statement that all Canadian Tire financial or loyalty systems were compromised.
How risky were the exposed passwords?
HIBP describes the passwords as PBKDF2 hashes, not plaintext passwords. Hashing is designed to make password recovery more difficult, but it does not make a weak or reused password harmless. Attackers can attempt to guess weak passwords, and a password exposed in one breach can be used to target accounts elsewhere.
The public listing does not establish the PBKDF2 iteration count, salt configuration or exact implementation. Do not assume that hashed passwords are impossible to crack.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What customers should do now
- Change the affected password. Sign in through the retailer’s genuine website or app rather than a link in an unexpected email.
- Change every reused password. Prioritize email, banking, shopping, social-media and other important accounts. Similar passwords should also be replaced.
- Turn on multifactor authentication. Use MFA wherever it is available, particularly for email and financial accounts.
- Use a password manager. A reputable manager can generate unique passwords for each site. Protect its master account with a strong password and MFA where available.
- Check the email address independently. Use Have I Been Pwned directly, not through an unsolicited message. A match indicates that the address appeared in the dataset; it does not prove every listed data category was exposed.
- Watch for impersonation. Be suspicious of password-reset messages, fake Canadian Tire or TransUnion notices, requests for card details, one-time codes, compensation claims and calls supposedly from Canadian Tire Bank.
- Review financial and credit activity. Check bank and card statements, credit reports, account-login alerts and unexpected password-reset notifications.
Canadian Tire says suspicious activity should be reported to the relevant financial institution and police. Do not automatically replace a payment card solely because of this incident; the company says full card numbers and CVVs were not included. Follow the card issuer’s advice if suspicious activity appears.
How can you tell whether you were affected?
Canadian Tire said customers whose records contained more detailed information were contacted by email through TransUnion Canada, or by mail when no valid email address was available. The company says people who did not receive a TransUnion email or postal notice have no action required specific to the incident.
That guidance does not override basic security hygiene. Anyone who reused the relevant password should change it even without receiving a notification.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →If HIBP reports a match but you never remember using Canadian Tire, SportChek, Mark’s/L’Équipeur or Party City, possible explanations include an old account, a shared account, an account at an affiliated brand, a historical record or a duplicate entry. None is confirmed for every unexpected match. Verify through HIBP directly and do not click links in unsolicited notifications.
What remains unknown?
- The exact number of distinct people affected
- The precise technical attack method
- The threat actor’s identity
- The initial vulnerability
- Whether the data was publicly posted, sold or otherwise distributed
The practical bottom line
This was a large retail e-commerce data incident, and the combination of contact information with password hashes creates meaningful phishing and account-takeover risk. But the available evidence does not support saying that Canadian Tire Bank accounts, Triangle Rewards balances, full payment-card credentials or CVVs were exposed.
For most readers, the highest-priority response is to change any reused password, enable MFA, verify notifications independently and treat follow-up messages as potential phishing.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errors
