10,816 Canada Goose customers in a data leak

On 18 March 2026, Canada Goose — the Canadian luxury outerwear brand — was reported to have French customers caught up in a large data leak first surfaced in February 2026 by the data-extortion group ShinyHunters. The France-related subset highlighted by trackers covers 10,816 customers, part of a much larger corpus of roughly 600,000 customer records (a 1.67 GB JSON dataset) posted on the group's leak site.

ShinyHunters claimed the data originated not from Canada Goose's own infrastructure but from a third-party payment processor compromised around August 2025. Canada Goose said it had "no indication of any breach of our own systems" and that its review found "no evidence that unmasked financial data was involved," while acknowledging that a historical dataset relating to past customer transactions had been published online.

The exposed records reportedly included:

• Customer names, email addresses and phone numbers
• Billing and shipping addresses
• IP addresses, device and browser information
• Order histories and order values
• Partial payment-card data (card brand, last four digits, and in some cases the first six BIN digits) plus payment-authorization metadata

As of the reporting date the incident remained under investigation: Canada Goose was reviewing the dataset to assess its accuracy and scope, had not confirmed a definitive count of affected customers, and the corpus stayed publicly available on the attackers' leak site.