On March 12, 2025, Lee Valley Tools, Ltd., a Canadian retailer specializing in woodworking, gardening, and home improvement products, discovered a significant data breach affecting its customers. Upon investigation, the company identified unauthorized access to its systems, which occurred on two separate occasions: first on October 8, 2024, and again on March 12, 2025.
The breach exposed sensitive personally identifiable information (PII) of 57,707 individuals in the United States. The compromised data included customer names, addresses, credit card numbers, expiration dates, and CVV security codes.
Of those affected, 2,656 individuals reside in Texas, 2,346 individuals reside in Massachusetts, 936 individuals reside in Maine, and 774 reside in New Hampshire. The California, Massachusetts, and New Hampshire Attorney Generals' offices were notified on April 9, 2025.
The Maine Attorney General's office was notified on April 10, 2025, the Vermont Attorney General's office on April 15, 2025 and the Texas Attorney General's office on April 11, 2025 and again on June 6, 2025.
As of today, Lee Valley Tools has not publicly disclosed detailed information regarding how the breach occurred or who was responsible. This type of breach can potentially lead to fraudulent charges, identity theft, and other financial crimes.
Following the discovery of the breach, Lee Valley Tools promptly notified state authorities and affected customers. Lee Valley Tools began notifying affected customers through written notices sent on April 15, 2025.
The company has provided customers with detailed information regarding the breach, along with recommended steps to protect themselves from potential fraud or identity theft.
If you have received a notification from Lee Valley Tools about this data breach, it is important to take immediate steps to protect yourself:
For more information about Lee Valley Tools, visit the company website.
A breach notice means your personal details could be circulating far beyond the organization involved. One practical step is continuous monitoring: services such as Identity Defender (included with an ExpressVPN subscription) can automatically check dark-web markets, flag new credit-file activity, and request removal of your information from data-broker sites.
This kind of “early-warning system” can’t undo a breach, but it can help you spot misuse quickly and limit further exposure. ExpressVPN is offering 61% off, risk-free for 30 days, with ID Theft Insurance included and no extra cost for those who sign up for one or two years.