What Happened
ShinyHunters leaked over 600,000 Canada Goose customer records on February 14, 2026, from a 1.67 GB dataset containing names, emails, phone numbers, billing/shipping addresses, IP addresses, order histories, device/browser info, and partial payment card details (e.g., card brand, last four digits, some first six digits/BIN, and authorization metadata), but the company denies any breach of its own systems, attributing the data to past transactions likely stolen from a third-party payment processor in August 2025. Canada Goose stated it found no evidence of unmasked financial data or compromise of its infrastructure and is reviewing the dataset’s accuracy and scope to determine affected customers and notify them if needed, while the exposure raises risks of targeted phishing and fraud despite lacking full card numbers. The incident aligns with ShinyHunters’ pattern of extorting e-commerce firms via third-party raids, with samples confirming detailed e-commerce order records resembling hosted storefront exports.
