Canadian Tire Faces Proposed Class Action Over 42 Million Records

Key Takeaways

• The proposed class action alleges that roughly 42 million records tied to more than 38 million customer accounts were extracted.
• Canadian Tire says the incident affected a specific e-commerce database, not Triangle Rewards or Canadian Tire Bank data.
• The case highlights the governance challenges created when customer information spans several retail banners and digital storefronts.

A proposed class action is putting new legal and operational scrutiny on Canadian Tire following a reported October 2025 breach of an e-commerce database. The litigation alleges that roughly 42 million records were extracted and more than 38 million unique customer accounts were affected across Canadian Tire, SportChek, Mark’s/L’Équipeur and Party City.

Those figures are allegations in litigation, not court findings. Even so, their scale illustrates the exposure that can develop inside an omnichannel retail business. A single customer may interact with several banners, create multiple profiles or have information retained across interconnected commerce systems. Record counts and account counts therefore are not necessarily the same thing, a distinction that will matter as the case proceeds.

According to KND Law, the proposed class action concerns customer information associated with the 2025 incident. Canadian Tire has said the affected database contained names, postal addresses, email addresses, years of birth, encrypted passwords and, in some cases, incomplete credit card numbers. The retailer said full card numbers and card verification values were not included.

That limitation could reduce certain payment-fraud risks, but it does not make the exposed information harmless. Names, addresses, birth years and email accounts can help criminals craft convincing phishing messages, impersonate retailers or attempt credential-stuffing attacks elsewhere. Encrypted passwords also create a longer-term question: how strong was the encryption, and were customers reusing the same credentials on other services?

Retail data is rarely confined to one tidy system. E-commerce databases can connect with order management, customer support, marketing, shipping and identity services. Security teams may protect payment environments closely while older customer databases, test systems or application interfaces receive less attention. For technology leaders, the Canadian Tire case is a reminder to map where personal information travels, not merely where a checkout transaction occurs.

Canadian Tire says the incident involved a specific e-commerce database and did not affect Triangle Rewards or Canadian Tire Bank data. It also says the vulnerability was resolved and the database secured. That scope clarification matters because loyalty and banking systems can hold different categories of information and operate under separate controls. Still, customers may not distinguish between back-end databases when all their interactions occur under familiar retail brands.

Reporting from Law360 Canada places the alleged account impact above 38 million. The gap between that number and the alleged 42 million extracted records raises practical questions for incident responders. Were duplicate entries involved? Did some customers hold accounts at multiple banners? Clear data lineage can help answer those questions and support more precise notifications.

For Canadian businesses, PIPEDA provides a central privacy framework, while provincial requirements may also apply. Organizations generally benefit from documenting safeguards, breach assessment decisions, notification processes and data-retention practices before an incident occurs. ISO/IEC 27001 can offer a structured approach to information-security management, although certification by itself does not establish that every database or application is adequately protected.

The litigation also arrives amid broader scrutiny of Canadian Tire. In a separate matter, CBC News reported that Quebec’s Office of Consumer Protection fined Canadian Tire just under $1.3 million in a 2026 false-advertising case. That proceeding is unrelated to the breach allegations, but it shows how regulatory, consumer-protection and privacy risks can accumulate around a major retail brand.

What should retail technology leaders take from this? Fast containment is only one part of the job. Accurate inventories, segmented access, tested response plans, defensible retention periods and plain-language customer notices can all reduce uncertainty. The proposed class action now shifts attention toward what information was held, how it was protected and whether Canadian Tire’s response met its legal obligations. Those questions will be decided through the litigation process, not by the size of the allegations alone.