On January 27, 2026, Canadian tire and auto service chain Active Green + Ross appeared on the leak site of the sinobi ransomware group. The company, which runs more than 65 Complete Tire & Auto Centres across Southern Ontario, is claimed to have had internal files exfiltrated during a ransomware attack. Public reporting indicates the number of people whose information was exposed remains unknown.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Watch Active Green + Ross
Get alerted the next time Active Green + Ross files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about Active Green + Ross’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
What Public Reporting Shows
Available reporting describes the incident as a ransomware attack in which attackers gained access to the company’s systems, encrypted data, and later published a sample of stolen internal files on their dark-web leak page. The exposed material consists of internal files rather than a structured database of customer records. No confirmed list of specific data types such as credit card numbers or Social Security equivalents has been published. The listing appeared on the sinobi leak site hosted at a .onion address tracked by ransomware.live.
Why This Matters for You and Your Family
When a local business like your neighborhood tire shop suffers a breach, the information it holds often includes names, addresses, phone numbers, vehicle details, service records, and payment information tied to everyday customers. If your family has ever bought tires, had brakes repaired, or used a promotion at one of Active Green + Ross’s 65-plus locations, some of your contact and transaction details may now sit in an attacker’s archive. Even a single leaked address or phone number can serve as the starting point for identity thieves, phishing campaigns, or harassment. Children’s names sometimes appear on family vehicle records or warranty documents, quietly expanding the exposure to the entire household.
The Doxxing and Identity-Chain Implications
Ransomware leaks rarely stop at one company. Attackers frequently cross-reference the fresh data against other breaches to build detailed profiles. A phone number from your last oil change can link to an email address used for your child’s gaming account, which in turn reveals a username that appears on social media or older forum posts. These identity chains allow criminals to move from simple data theft to targeted doxxing, account takeovers, or extortion. Credential leaks like this one regularly cascade into gaming account compromises because the same password or recovery email is reused across services. Once attackers control a child’s Roblox, Fortnite, or Discord account, they can extract further personal details or use the account to spread malware to friends.