Canada Goose data leak exposes 600K customer records

A Canada Goose data leak is under investigation after hackers published a database containing hundreds of thousands of customer records. The company says it has not detected a direct breach of its internal systems but continues analyzing the exposed data to understand the source and potential impact.

Large customer database released

The threat group known as ShinyHunters claimed responsibility for the leak and shared a dataset containing more than 600,000 entries. The records appear linked to past online purchases and include detailed customer information.

Exposed fields include names, email addresses, phone numbers, shipping and billing addresses, and IP data. Purchase history and device information were also present, allowing attackers to build detailed profiles of customers.

Partial payment information included

The dataset does not contain complete payment card numbers. However, it includes card brands and fragments of card identifiers in some entries. Combined with personal information, this data can support convincing fraud attempts.

Attackers commonly use partial payment details to create realistic phishing messages or impersonate customer support communications.

Possible third-party origin

Canada Goose stated there is no evidence that its own infrastructure was compromised. The company believes the records may originate from an external service provider connected to transaction processing. Investigators are reviewing the dataset to confirm how the exposure occurred.

Known cybercrime actors

ShinyHunters has a history of leaking large corporate datasets to gain attention and pressure organizations. Stolen databases are often used for extortion, resale, or targeted social-engineering campaigns.

Customer risk and precautions

Even without full financial data, customers may face phishing attempts and account takeover risks. Personalized messages referencing purchases can appear legitimate and increase trust.

Users should remain cautious with unexpected emails, update account passwords, and enable multi-factor authentication where possible.

Conclusion

The Canada Goose data leak shows how exposed transaction records can still create serious risk even without a direct breach of company systems. Third-party services remain a common weak point in modern data ecosystems. Ongoing analysis will determine the full scope and the number of affected individuals.