iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Toys “R” Us Canada said a cybersecurity incident may have exposed customers’ names, postal addresses, email addresses and phone numbers. The company said passwords and credit-card details were not exposed. It said it discovered the incident on July 30, 2025, and notified customers on October 23, 2025.
Was Toys “R” Us Canada hacked?
The company reported a cybersecurity incident after information allegedly stolen from its database appeared on the unindexed internet. Global News and The Canadian Press reported that Toys “R” Us Canada became aware of the incident on July 30, 2025, hired cybersecurity experts to contain and investigate it, and notified customers on October 23, 2025. The public reports do not establish how the attacker gained access or who was responsible. Global News · The Canadian Press
What information did the breach expose?
The reported information involved customers’ names, postal addresses, email addresses and phone numbers. Toys “R” Us Canada said “no passwords, credit card details or similar confidential data” were exposed, according to Global News. The company’s privacy policy lists other kinds of information it may collect, such as payment, delivery, loyalty, registry and transaction information; that general list does not mean those categories were exposed in this incident. Toys “R” Us Canada privacy policy
Did Toys “R” Us Canada lose my credit-card details?
The company’s statement specifically said credit-card details and passwords were not exposed. The public reports do not establish a verified number of affected customers, and they do not report identity theft, a ransom demand, a regulator finding or a technical cause. If you received a notice, rely on its instructions to determine whether your information was involved rather than assuming every customer was affected.
#1 Best Overall
What should I do if I got the breach email?
The Office of the Privacy Commissioner of Canada advises people to read a breach notice carefully and take protective steps when a breach could create a real risk of significant harm. Office of the Privacy Commissioner of Canada breach guidance
- Check whether the notice is genuine. Use contact details on the official Toys “R” Us Canada site rather than links or phone numbers in an unexpected message. Read the notice to see whether it says your information was included.
- Be alert for targeted phishing. Someone with your name, email, phone number or postal address could make an unsolicited message seem credible. Treat unexpected messages or calls cautiously, even if they mention Toys “R” Us.
- Do not share credentials or payment data in response. Toys “R” Us Canada’s privacy policy says the company will not request passwords or credit-card information by email. Do not reply with those details or provide them through an unsolicited link.
- Contact the company through its official privacy channels if you need clarification. Its Canadian privacy-rights page provides ways to request access to, correction of or deletion of personal information. Toys “R” Us Canada privacy rights
How do I contact Toys “R” Us Canada about my personal information?
Use the privacy-rights page to submit an access, correction or deletion request. Toys “R” Us Canada says it will respond within 30 days or as otherwise permitted by law. The page also identifies the Office of the Privacy Commissioner of Canada and Quebec’s Commission d’accès à l’information as complaint channels. Toys “R” Us Canada privacy rights
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
