Canada Goose denies systems breach after ShinyHunters leaks customer orders
Canada Goose says a dataset of past customer transactions leaked online by the ShinyHunters extortion group did not come from a breach of its own systems, after the group claimed to have taken more than 600,000 customer records.
The leaked records appear to be genuine e-commerce order data, and that makes them useful to fraudsters regardless of where the leak began. Names, addresses, purchase histories and partial card details are enough to build convincing phishing and refund scams aimed at buyers of a premium brand.
What happened
ShinyHunters posted a 1.67 GB archive on its leak site in mid-February. In a statement reported by The Record, Canada Goose said it was aware that "a historical dataset relating to past customer transactions has recently been published online" and that "at this time, we have no indication of any breach of our own systems." It said it was reviewing the data for accuracy and scope, and that its review showed no evidence that unmasked financial data was involved.
Breach-notification service Have I Been Pwned added the data and lists 581,900 unique email addresses across about 920,000 records, with the most recent transaction dated July 2025, CyberInsider reported. The records include names, email addresses, phone numbers, billing and shipping addresses, IP addresses, order histories and partial payment card data such as card brand and last four digits. Full card numbers do not appear in the data.
Reports have linked the data to a breach at a third-party service provider in August 2025. That explanation has not been confirmed publicly, and Canada Goose has not named a provider.
What we don't know yet
It remains unclear exactly where the data was taken from, how many Canadian customers are included and whether the company will send individual notices. A U.S. law firm has said it is investigating possible class action claims.
What to do
- Check whether your email address appears on Have I Been Pwned.
- Be suspicious of emails or texts about Canada Goose orders, refunds or warranty claims, especially ones that cite real past purchases.
- Review card statements for unfamiliar charges and contact your card issuer if you see any.
