TL;DR: If you live in Canada and shop, fly, pay a power bill or have ever left a Crime Stoppers tip, odds are good you’re in at least one recent breach. The big ones: Canadian Tire (38.3 million emails), Loblaw (about 2 million people), WestJet (1.2 million, passports included), Canada Goose (about 582,000 emails), Nova Scotia Power (about 280,000, some SINs and bank accounts) and Crime Stoppers (1.5 million tips). Here’s what each exposed and the one checklist that covers them all.
The list
| Breach | When | People / records | Most sensitive data | Guide |
|---|---|---|---|---|
| Canadian Tire (incl. SportChek, Mark’s, Party City) | Discovered Oct 2025 | ~38.3M emails (42M records) | Hashed passwords; DOB and partial cards for a subset | Details |
| Loblaw | Detected Mar 2026, notices Oct 2026 | ~2M people | DOB, loyalty card numbers, partial payment cards | Details |
| Crime Stoppers (via P3 Global Intel) | Stolen Mar 2026, reported Oct 2026 | 1.5M+ tips | Addresses, phones, plates; some full names | Details |
| WestJet | Disclosed Jun 2025 | 1.2M people | Passports and government IDs | Details |
| Canada Goose | Data published Feb 2026 | ~582,000 emails | Order history, partial cards | Details |
| Nova Scotia Power | Mar–Apr 2025 | ~280,000 people | SINs, bank account numbers, licences | Details |
| Toys "R" Us Canada | Learned Jul 2025 | Not disclosed | Names, addresses, phones, emails | Details |
| Canada Computers | Dec–Jan guest checkouts | "Limited" | Credit card details | Details |
Sources for each are in the linked guides and listed below.
What jumps out
Retail is the biggest target by volume. Canadian Tire alone produced roughly one record for every person in the country. Most of it is contact data, which fuels phishing rather than instant fraud.
Identity documents are the scariest. WestJet’s passports and Nova Scotia Power’s SINs and bank numbers can’t be "reset" like a password. Those breaches deserve long-term attention.
Notifications lag. Loblaw detected its breach in March 2026 and started notifying people in October. Months can pass between theft and your inbox hearing about it.
Your data adds up. One breach gives a scammer your email. Another gives your birthday. A third, your address. Combined, they’re enough to impersonate you convincingly.
One checklist for all of them
- Check your email against all known breaches with our free exposure checker or Have I Been Pwned.
- Change reused passwords, starting with email and banking.
- Turn on 2FA, preferably app-based (guide).
- Claim any free monitoring offered in notification letters, through official links only.
- Place a fraud alert if ID documents, SIN or DOB leaked (how).
- Pull your credit reports for free (how).
- Treat breach-themed messages as suspicious. Fake "compensation" and "verify your account" emails always follow big breaches.
Know your rights
Companies must notify you when a breach creates a real risk of significant harm. See what a notice must include and how to complain. Quebec residents have extra rights under Law 25.
Frequently Asked Questions
What is the biggest Canadian data breach of 2025–2026?
By volume, Canadian Tire: Have I Been Pwned lists about 38.3 million email addresses across 42 million records.
Which Canadian breaches exposed SINs or passports?
Nova Scotia Power exposed some SINs and bank account numbers. WestJet exposed passports and other government IDs.
How do I know if I was in a Canadian data breach?
Check your email with a breach checker like Have I Been Pwned or our free exposure checker, and look for notification letters.
What should I do if I’m in several breaches?
Change reused passwords, turn on 2FA, claim free monitoring, consider a fraud alert and check your credit reports.
Sources
- SecurityWeek: Canadian Tire data breach impacts 38 million accounts
- CP24: Loblaw says March data breach affected about two million Canadians
- MobileSyrup: Canadian Crime Stoppers tips leak report
- SC World: WestJet breach hits 1.2 million people
- CyberInsider: Canada Goose data breach
- The Record: Nova Scotia Power cyberattack
- Barchart (Canadian Press): Toys R Us Canada breach
- TEISS: Canada Computers data breach
- Have I Been Pwned