Canadian Tire Data Breach Exposes 38M Customer Records
What Happened – In October 2025 Canadian Tire disclosed that a cyber‑incident compromised 38,306,562 customer accounts. The exposed data set includes names, email addresses, phone numbers, physical addresses, dates of birth, partial credit‑card details (card type, expiry, masked number) and password hashes stored with PBKDF2.
Why It Matters for Trust & Control Assurance –
- The incident highlights a gap in identity and access management – weak credential protection and lack of multi‑factor authentication can lead to large‑scale data exposure.
- Continuous control‑assurance programs (e.g., NIST CSF 2.0 → Protect function) require defensible evidence that password storage, MFA enforcement and credential‑monitoring are operating effectively.
- Demonstrating robust access‑control evidence is a core component of audit readiness across multiple frameworks.
Who Is Affected – Retail customers of Canadian Tire; the breach impacts the broader retail/e‑commerce sector that handles personal and payment‑related data.
Recommended Actions –
- Review and upgrade password‑hashing algorithms; consider salted Argon2 or bcrypt in addition to PBKDF2.
- Enforce MFA for all privileged and customer‑facing accounts.
- Deploy continuous monitoring of credential use and anomalous login activity.
- Map these improvements to your control‑assurance framework to generate audit‑ready evidence.
Technical Notes – The breach exposed 38 M unique email addresses, names, phone numbers, physical addresses, dates of birth, partial credit‑card data (card type, expiry, masked number) and PBKDF2 password hashes. No bank‑account or loyalty‑program data were reported as compromised. Source: Have I Been Pwned – Canadian Tire breach