Canadian Tire's 38-million-account breach, eight months on: what an attacker can still piece together

In February 2026, Have I Been Pwned added the Canadian Tire breach to its database. The headline number was big enough to make the news: about 42 million records, covering 38.3 million unique email addresses. Then the news moved on.

The data didn't. A breach record doesn't expire when the coverage does. It sits in collections that get traded, merged and searched for years, and every month it gets easier to connect to everything else a person has left online.

Your breach isn't history. It's an index.

#What was in the breach

According to Have I Been Pwned, the exposed data included names, email addresses, phone numbers and physical addresses, along with passwords stored as PBKDF2 hashes. For some records it also included dates of birth and partial payment card data. SecurityWeek reported the scale of the breach at the end of February.

Hashed passwords are better than plain text, and PBKDF2 is designed to be slow to crack. But slow isn't never. Short or common passwords can still fall, and anyone who reused one is exposed wherever else they used it.

The rest of the record doesn't need cracking at all. A name, an email, a phone number and a home address are already the four best starting points for finding someone.

#How one record becomes a footprint

To show how this works without touching anyone's real data, here's a chain built on a synthetic person. Every detail below is invented: the email uses a reserved .example domain and the phone number is a fictional 555 number.

Suppose a breach record reads: Alex Doe, alex.doe@example.com, 604-555-0142, an address in Abbotsford.

1. The email. Checking which services an address is registered with often turns up a handful of accounts: a developer platform, a fitness app, an old forum.
2. The handle. One of those accounts uses the handle alexd_bc. People reuse handles, so the same name shows up on two more sites, one with a profile photo.
3. The photo. A reverse image search on that photo finds it again on a professional profile, which names an employer.
4. The phone. The number is linked to a messaging account with a different display name and a second photo.
5. The address. Combined with the name, it confirms the town and narrows down everything above to one person instead of a dozen Alex Does.

None of these steps is sophisticated. Each one simply turns the last finding into the next starting point. That's how a single leaked row becomes a profile, and why the age of the breach matters less than you'd think.

This is also why Nuculair doesn't follow a chain like this on its own. A photo match or a linked account is exactly the kind of step that can jump to the wrong person, so the engine waits for an operator to confirm it before going further. We wrote about that rule in Only expand what an operator confirms.

#What people do with it

The point of assembling a footprint is usually one of three things:

• Targeted phishing. A message that mentions your real address, your phone number or a store you actually shop at is far more convincing than a generic one.
• Password reuse. If an old password can be recovered, it gets tried everywhere else, automatically.
• Social engineering. Support lines and account-recovery flows often ask for exactly the details that leaked: name, address, phone, date of birth.

#What to do now

If you've ever had a Canadian Tire account, these steps are worth ten minutes:

1. Check your email on Have I Been Pwned to see which breaches it appears in.
2. Change any reused password. If the password you used there is used anywhere else, change it there first. A password manager makes unique passwords painless.
3. Turn on two-factor authentication, preferably with an authenticator app or a passkey rather than text messages.
4. Treat messages that use your details as a warning sign, not a credential. Don't call numbers or follow links from unexpected messages, even when they know your address.
5. Consider a fraud alert with Canada's credit bureaus, Equifax Canada and TransUnion Canada, if your date of birth or card details may have been in your record.
6. See what else connects to your email. The breach is only the starting point; the question is what it leads to.

For more on staying safe after a breach, the Government of Canada's Get Cyber Safe has plain-language guides, and you can report fraud attempts to the Canadian Anti-Fraud Centre.

#Sources

• Have I Been Pwned, Canadian Tire breach
• SecurityWeek, Canadian Tire data breach impacts 38 million accounts, February 28, 2026
• Government of Canada, Get Cyber Safe
• Canadian Anti-Fraud Centre