Toys “R” Us Canada confirms data breach after customer information leaked online

Toys “R” Us Canada has begun notifying customers of a data breach after confirming that threat actors leaked customer information stolen from its systems earlier this year.

The toy retailer discovered the breach on July 30, 2025, when a threat actor posted on the dark web what they claimed to be customer data belonging to the company. A subsequent investigation, conducted with the assistance of third-party cybersecurity experts, verified that the exposed data was authentic.

“On July 30, 2025, we became aware via a posting on the unindexed internet that a third party was claiming to have stolen information from our database,” the company stated in a letter sent to affected customers. “We immediately hired third-party cybersecurity experts to assist with containment and to investigate the incident.”

Investigators determined that the unauthorized party had copied certain records from the company’s customer database, which contained personal information. The leaked data varies by individual but may include names, physical addresses, email addresses, and phone numbers. Toys “R” Us Canada said account passwords, payment card details, and other sensitive financial information were not affected.

Toys “R” Us Canada, a subsidiary of global toy retailer Toys “R” Us, operates about 40 stores across the country, offering toys, games, and children’s apparel. The company stated that it has since enhanced the security of its IT infrastructure and is working with cybersecurity specialists to prevent future incidents. It has also begun notifying relevant privacy regulators in Canada about the breach, as required under federal law.

Toys “R” Us Canada has not disclosed how many customers were affected by the breach or whether the attackers made any ransom demands. Customers are being advised to remain cautious of phishing attempts or fraudulent messages that may impersonate Toys “R” Us and attempt to collect personal details. The company emphasized that it will never ask customers to provide sensitive information via email or text message.