Overview
- The company says it learned of the breach on July 30, 2025, after an online post suggested data theft, and it hired third-party cybersecurity experts to contain and investigate.
- Investigators found unauthorized actors copied a subset of customer records containing names, addresses, emails, and phone numbers.
- Toys “R” Us Canada says passwords and credit card details were not exposed, and it reports no evidence of fraudulent use of the copied data.
- The retailer has implemented additional security measures, engaged specialized legal counsel, and is reporting the incident to applicable privacy regulators.
- The company has not disclosed how many customers or which banners were affected, and it is advising customers to watch for phishing or spoofing attempts.