The week in breach news Mar 4, 2026

More than 42 million user accounts were reportedly affected during the October 2025 data breach at Canadian retail giant Canadian Tire.

The incident was discovered on October 2, 2025, when the company identified unauthorized access to its e-commerce database, marking one of the largest retail data breaches in Canada. At the time, Canadian Tire stated that the compromised data included names, email addresses, dates of birth, encrypted passwords and, in some cases, partial credit card numbers. Last week, breach notification site Have I Been Pwned updated the associated dataset, reporting that more than 42 million records were impacted during the incident, including over 38 million unique email addresses.

According to the website, the leaked data also includes addresses, phone numbers and gender information in addition to what the company initially disclosed. Canadian Tire has not yet publicly confirmed the updated number of affected individuals.

In yet another cyber incident exposing a massive volume of user data, roughly 38 million people were likely impacted by a data breach at European DIY retail chain ManoMano.

The attack, which occurred in January, was disclosed this week as ManoMano began notifying potentially affected customers. The company said the exposure stemmed from a compromised subcontractor in its customer service department. While ManoMano did not specify which platform was affected, reports indicate that attackers accessed its Zendesk instance used for customer support.

Meanwhile, a threat actor called Indra claimed responsibility on the hacking forum BreachForums, stating that approximately 43 GB of data was stolen. The actor alleges the data includes information tied to 37.8 million user accounts, more than 900,000 service tickets and over 13,000 attachments.

Compromised user data continues to be the theme of the week as millions of CarGurus users may have had their personal and financial information exposed after a threat actor group published a massive dataset allegedly stolen from the U.S.-based automotive marketplace.

The ransomware group ShinyHunters added CarGurus to its Tor-based leak site, claiming it stole personally identifiable information (PII) and internal corporate data. While the group initially stated it had taken 1.7 million records, it later released a 6.1 GB archive reportedly containing data tied to approximately 12.4 million accounts. The leaked information allegedly includes email addresses, IP addresses, full names, phone numbers, physical addresses, user account IDs, finance pre-qualification data, finance application outcomes, dealer account details and subscription information.

CarGurus has since confirmed the incident and launched an investigation with the assistance of a leading independent cybersecurity firm.

The ransomware group Qilin has added the Transport Workers Union of America (TWU) Local 100 chapter to its data leak site, claiming it breached the organization and published all stolen data on the dark web.

TWU Local 100 represents tens of thousands of transportation workers in and around New York City. While the ransomware group has not disclosed the volume or type of data taken, reports suggest the incident may have impacted the personally identifiable information (PII) and protected health information (PHI) of approximately 67,000 active and retired members.

Hennessy Advisors, Inc., a California-based investment firm, announced a cybersecurity incident that impacted the personal information of more than 12,000 individuals.

According to a filing with the Office of the Maine Attorney General, the incident occurred on March 30, 2025, through an external system breach. During the incident, an unauthorized individual gained access to the company's network and may have acquired records containing personally identifiable information (PII), including names combined with driver's license numbers and financial account details.