58 minutes ago
Data belonging to roughly 600,000 customers of Canada Goose has surfaced on the dark web after the extortion group ShinyHunters published a dataset tied to the luxury outerwear brand. According to a customer notice posted at the company's dedicated incident site, Canada Goose Holdings became aware on February 14, 2026 that customer transaction information relating to approximately 600,000 clients globally had been published online. Our investigation team indexed 839,113 rows in connection with this listing, with an estimated attack date of February 16, 2026. The company says the data appears to have been accessed through a third-party service provider, not through a breach of Canada Goose's own systems.
Canada Goose's customer notice lists additional fields tied to the exposed transactions, which covered purchases made between 2021 and June 2025: full name, postal address, phone number, email address, the last four digits of credit cards, the bank identification number, the name of the item purchased, its price, and its size. Reporting by TechRadar, citing sample records reviewed by BleepingComputer, also described billing and shipping addresses, IP addresses, device and browser information, and order histories.
The company states it has no indication that any complete or usable payment card information was involved.
Not every individual is affected by every type of data listed here.
Canada Goose's customer notice lists additional fields tied to the exposed transactions, which covered purchases made between 2021 and June 2025: full name, postal address, phone number, email address, the last four digits of credit cards, the bank identification number, the name of the item purchased, its price, and its size. Reporting by TechRadar, citing sample records reviewed by BleepingComputer, also described billing and shipping addresses, IP addresses, device and browser information, and order histories.
The company states it has no indication that any complete or usable payment card information was involved.
Not every individual is affected by every type of data listed here.