Toys "R" Us experienced a cybersecurity incident where an unauthorized party accessed a database containing customers’ personal information. The investigation, initiated after online claims of stolen data, confirmed that some records—including names, addresses, email addresses, and phone numbers—were copied. While no passwords or credit card details were compromised, the company acknowledged the risk of potential misuse, though no evidence of fraudulent activity has been detected yet. Customers were advised to remain vigilant against phishing attempts, such as suspicious emails or texts impersonating Toys "R" Us. The company stated it had robust IT protections in place but has since enhanced security measures to mitigate future risks. The breach highlights vulnerabilities in customer data protection, though the immediate financial or operational impact appears limited to reputational concerns and proactive customer notifications.

On February 2, 2017, the California Office of the Attorney General reported a data breach involving Toys 'R' Us-Delaware, Inc., which was discovered on January 17, 2017. The breach involved unauthorized attempts to access Rewards 'R' Us accounts and may have affected member account information, including names, email addresses, and mailing addresses.

The California Office of the Attorney General reported a data breach involving Toys 'R' Us-Delaware, Inc. on February 27, 2015. The breach occurred between January 28, 2015, and January 30, 2015, potentially affecting a small percentage of Rewards 'R' Us accounts due to unauthorized access attempts related to breaches at other companies. Specific details on the number of affected individuals and types of information compromised are unknown.