On March 12, 2025, Lee Valley Tools, Ltd., a Canadian retailer specializing in woodworking, gardening, and home improvement products, discovered a significant data breach affecting its customers. Upon investigation, the company identified unauthorized access to its systems, which occurred on two separate occasions: first on October 8, 2024, and again on March 12, 2025.
The breach exposed sensitive personally identifiable information (PII) of 57,707 individuals in the United States. The compromised data included customer names, addresses, credit card numbers, expiration dates, and CVV security codes.
Of those affected, 2,656 individuals reside in Texas, 2,346 individuals reside in Massachusetts, 936 individuals reside in Maine, and 774 reside in New Hampshire. The California, Massachusetts, and New Hampshire Attorney Generals' offices were notified on April 9, 2025.
The Maine Attorney General's office was notified on April 10, 2025, the Vermont Attorney General's office on April 15, 2025 and the Texas Attorney General's office on April 11, 2025 and again on June 6, 2025.
As of today, Lee Valley Tools has not publicly disclosed detailed information regarding how the breach occurred or who was responsible. This type of breach can potentially lead to fraudulent charges, identity theft, and other financial crimes.
Following the discovery of the breach, Lee Valley Tools promptly notified state authorities and affected customers. Lee Valley Tools began notifying affected customers through written notices sent on April 15, 2025.
The company has provided customers with detailed information regarding the breach, along with recommended steps to protect themselves from potential fraud or identity theft.
If you have received a notification from Lee Valley Tools about this data breach, it is important to take immediate steps to protect yourself:
For more information about Lee Valley Tools, visit the company website.