TL;DR: Toys "R" Us Canada learned on July 30, 2025 that customer records had been posted online, and later emailed customers. Third-party experts confirmed an unauthorized party copied records that may include names, addresses, email addresses and phone numbers. The company says no passwords or credit card details were involved. That’s still enough for convincing scam texts and emails, especially around the holidays when parents expect toy deliveries.
What happened
According to a Canadian Press report carried by Barchart, someone posted information on the deep web claiming it came from Toys "R" Us Canada’s databases. The company learned about it on July 30, brought in outside cybersecurity experts, and they confirmed an unauthorized party had copied customer records. Customers started getting notification emails in October 2025.
What data was involved
| Data | Status |
|---|---|
| Names | May be included |
| Mailing addresses | May be included |
| Email addresses | May be included |
| Phone numbers | May be included |
| Passwords | Not involved, per the company |
| Credit card details | Not involved, per the company |
The company didn’t say how many customers were affected.
Why "just contact details" still matters
A file with your name, home address, email and phone number is a scammer’s starter kit. Add the fact that you buy from a toy store, and they can guess you have kids. Expect:
- "Your Toys R Us order is delayed, pay a redelivery fee" texts;
- fake holiday giveaways and "loyalty rewards" emails;
- parcel scams that line up suspiciously well with real orders.
None of this needs a password. It just needs you to click once while juggling a toddler.
What to do
- Look for the notification email from Toys "R" Us Canada and keep it.
- Check your email on Have I Been Pwned or our free exposure checker.
- Treat delivery texts with suspicion through the holiday season. Track orders by logging in yourself, not through links.
- Forward scam texts to 7726 so your carrier can block them. See our 7726 and Spam Reporting Centre guide.
- Report losses to police and the Canadian Anti-Fraud Centre.
Your rights
Under PIPEDA, organizations must notify you when a breach creates a real risk of significant harm. If you think a notice was inadequate, you can file a complaint. Our guide to complaining to the Privacy Commissioner explains how.
Frequently Asked Questions
When did Toys R Us Canada find out about the breach?
The company says it learned of the incident on July 30, 2025.
What data was exposed in the Toys R Us Canada breach?
Records may include names, addresses, email addresses and phone numbers.
Were passwords or credit cards stolen?
The company says no passwords or credit card details were involved.
How many people were affected?
The company has not publicly said.
Sources
- Barchart (Canadian Press): Toys R Us Canada customers notified of breach
- Have I Been Pwned
- Canadian Anti-Fraud Centre