Canadian Tire has disclosed that a recent breach of its e-commerce systems exposed sensitive customer data linked to its online retail platforms, including SportChek, Mark’s/L’Équipeur, and Party City.
According to the company, the attack affected users who had active online accounts. Exposed information reportedly includes names, mailing addresses, email addresses, and partial birth years. In certain cases, the data also included encrypted passwords and fragments of credit card numbers—similar to what might appear on a printed receipt.
Canadian Tire noted that the full dates of birth for about 150,000 customers were also compromised. Importantly, it emphasized that the data does not appear sufficient for unauthorized purchases or account takeovers. The company further confirmed that its in-store operations and systems remain unaffected.
The vulnerability, which was identified on October 2, has since been patched. Canadian Tire said it is collaborating with internal security teams and external cybersecurity experts to strengthen its defenses. Affected customers will reportedly receive notifications and may be offered credit monitoring services through TransUnion Canada.
In a message to customers, the retailer stressed that no further suspicious behavior has been detected. Nonetheless, it reminded consumers of best practices: using strong, unique passwords, enabling multi-factor authentication, and staying alert for unusual account activity.
This breach comes amid a rising tide of cyber incidents in Canada.
The Canadian Tire incident will likely revive industry debate around the role of insurers, regulators, and technology providers in strengthening cyber resilience for consumers and firms alike.
