The privately-operated 407 Express Toll Route says in a statement that the stolen data is limited to account names and phone numbers, and no credit card or banking information was taken.
It says the incident is being investigated as an “inside theft of data,” and no external breach of its systems is suspected.
The company says it was informed of the issue last Thursday and immediately launched an investigation.
It has also notified police, the federal privacy commissioner and the Ontario Ministry of Transportation.
The 407 ETR bills itself as “the world’s first all-electronic, barrier-free toll highway,” running 108 kilometres from Burlington to Pickering.