Hackers breached Toys "R" Us Canada’s systems and leaked a subset of customer records, exposing names, postal addresses, email addresses, and phone numbers. While no passwords, credit card details, or highly sensitive financial data were compromised, the leaked information poses significant risks for phishing, identity theft, and fraud. The company detected the breach after hackers posted about it on the dark web and responded by hiring a third-party cybersecurity firm for forensic analysis. Enhanced security measures were implemented to prevent future incidents, though the attack method and perpetrators remain unidentified. Authorities were notified, and affected customers were advised to remain vigilant against potential scams. There is currently no evidence of data misuse, but the exposure of valid personal details increases the likelihood of targeted social engineering attacks.

Toys "R" Us Canada disclosed a data breach where an unauthorized third party copied customer records, including names, addresses, emails, and phone numbers, from its databases. The stolen data was posted on the unindexed internet (potentially the dark web), though no passwords, credit card details, or evidence of misuse were reported. The breach was discovered on July 30, but customer notifications were delayed. The company hired cybersecurity experts to confirm the incident, engaged legal counsel, and is reporting the breach to privacy regulators. While no financial or highly sensitive data was compromised, the exposure of personal information raises risks of phishing, spoofing, and fraudulent schemes targeting affected customers. The company advised vigilance against suspicious communications and committed to enhancing security measures to prevent future incidents.

Toys "R" Us Canada suffered a data breach in July, where threat actors accessed and leaked customer information on the dark web. The exposed data included names, email addresses, physical addresses, and phone numbers—though no financial details (e.g., credit cards or passwords) were compromised. The breach heightened risks of identity theft and phishing scams targeting affected shoppers. The company promptly notified customers, aligning with regulatory requirements like Canada’s PIPEDA. While the intrusion method remains speculative, reports suggest potential ties to broader campaigns exploiting software vulnerabilities, such as OAuth token abuse via integrations like Salesloft’s Drift or CL0P’s targeting of Oracle E-Business Suite systems. The incident underscores challenges in securing legacy systems amid digital transformation, with experts emphasizing the need for data minimization and robust threat detection. Customers were advised to monitor for suspicious activity and enhance security measures like two-factor authentication. The breach has sparked industry discussions on zero-trust architectures and third-party vendor risks, while regulators may impose fines if negligence is confirmed.