600,000 Customer Canada Goose Records Exposed by Hackers

The notorious extortion group ShinyHunters claims to have stolen more than 600,000 customer records from the luxury outerwear brand Canada Goose. The 1.67 GB leaked dataset contains sensitive personal information and payment-related metadata, exposing thousands of customers to potential phishing and social engineering attacks.

The leaked JSON archive includes customer names, email addresses, phone numbers, billing and shipping addresses, IP addresses, and detailed order histories. Additionally, partial payment card information, such as card brands and truncated card numbers (BIN and last four digits), was exposed. The threat actors stated that the data originated from a third-party payment processor breach dating back to August 2025, rather than a direct intrusion into Canada Goose’s internal infrastructure.

Founded in 1957, Toronto-based Canada Goose is a global leader in performance luxury apparel. While the company acknowledged the online publication of a “historical dataset,” it maintained that there is no evidence of a breach within its own systems. ShinyHunters, the group behind the leak, is well-known for high-profile data thefts targeting major e-commerce platforms and cloud environments.

Canada Goose is currently reviewing the dataset to assess its accuracy and scope. Although full financial data remains unmasked, the exposure of detailed purchase histories and contact information provides ample material for fraudsters to target high-value customers.