A dataset of around 600,000 Canada Goose customer records appeared in February 2026 on the leak site of the data-extortion group ShinyHunters. The archive, distributed as a 1.67 GB JSON file, contained roughly 920,000 lines of order and refund data covering names, email addresses, phone numbers, billing and shipping addresses, IP addresses, device and browser details, order histories, and partial payment card information.\n\nThe partial card data included card brand, the last four digits, and in some cases the first six digits or BIN. Full card numbers were not present. Canada Goose stated publicly that it had found no evidence of a breach of its own systems and that the data appears to have come from a third-party payment processor that handled past customer transactions. ShinyHunters attributed the underlying compromise to an August 2025 incident at that third party. Independent researchers noted that much of the data appeared to date from 2021 to 2023, raising the possibility that ShinyHunters republished older material.\n\nFor affected customers, the practical risk is targeted phishing and order-related fraud rather than direct payment compromise. Scams referencing real past orders, shipping addresses, or partial card details are now plausible. Affluent customers should be alert to messages claiming order issues or refund offers and should verify any such contact through the canadagoose.com customer service channel rather than through links in unsolicited messages.

Premium apparel brands collect customer identity, contact details, addresses, order history, loyalty or clienteling records, and payment-adjacent data across retail and e-commerce operations.

In February 2026, the data extortion group ShinyHunters published a dataset of more than 600,000 Canada Goose customer records on its dark-web leak site. Canada Goose responded publicly, stating that it had no indication of a breach of its own systems and that the data appears to relate to past customer transactions handled by a third party. The company says its review found no evidence that unmasked financial data was exposed. As of early 2026, the investigation is ongoing, no formal customer notifications have been confirmed, and no regulatory action has been publicly announced.