[News](/news) Data breach reported by Canada Goose [Blog](/blog)[Breaches](/breaches)[Resources](/resources)[News](/news) # Data breach reported by Canada Goose ##### [UpGuard Team](/team/upguard) February 17, 2026 ### Key facts: Canada Goose data breach * **Date reported**: February 15, 2026. * **Unauthorized access identified**: August 2025 (estimated date of third-party breach). * **Target entity**: Canada Goose (canadagoose.com). * **Source of breach**: ShinyHunters (via a third-party payment processor). * **Data types**: Personal information, e-commerce order details, and partial payment card information. * **Status**: Confirmed; ShinyHunters claims to have acquired over 600,000 customer records. * **Severity**: High; the exposed data includes detailed transaction history and partial financial information. Protect against attacks like ShinyHunters. [See how UpGuard helps.](https://www.upguard.com/product/breach-risk/threat-monitoring) ## What happened in the Canada Goose data breach? Canada Goose (canadagoose.com) was the subject of a data breach incident reported on February 15, 2026, involving the threat actor group known as ShinyHunters. The extortion group claims to have acquired over 600,000 customer records containing personal and payment-related data. While the vendor stated that their own systems show no evidence of a breach, the dataset appears to consist of past transaction records believed to have originated from a third-party payment processor breach occurring in August 2025. The released dataset, provided in JSON format, contains detailed e-commerce order records and partial payment card information. This high-severity incident underscores the risks associated with third-party data handling and supply chain vulnerabilities. The exposure of such detailed transaction history and partial financial data typically increases the risk of targeted phishing and fraudulent activities against the affected customer base. ## Who is behind the incident? ShinyHunters is a prolific data extortion group known for targeting high-profile organizations to steal and leak large-scale databases. The group has been active for several years, frequently operating on underground forums where they sell or publicly release stolen information to pressure victims. Their methods often involve exploiting misconfigured cloud storage, vulnerabilities in third-party services, or credential stuffing. ShinyHunters has a history of successful campaigns across various sectors, demonstrating a consistent focus on acquiring sensitive consumer data, including personal identifiers and financial records, for monetization or reputational damage. ## Impact and risks for Canada Goose customers For customers, the exposure of 600,000 records including e-commerce details and partial payment information presents significant security risks. This data could potentially be used for identity theft, credential abuse, or highly targeted phishing attacks. Because the records include specific order histories, malicious actors might craft convincing scams that reference past purchases to gain the trust of victims and extract further sensitive information. Incidents of this nature often lead to increased fraudulent activity and long-term privacy concerns for consumers. Affected individuals should monitor their financial statements closely, update account credentials, and remain skeptical of unsolicited communications. Maintaining transparency regarding third-party security helps mitigate these ongoing risks and allows users to take proactive defensive measures. ## How to protect against similar security incidents [Get instant alerts when your data appears on the dark web](https://www.upguard.com/product/breach-risk/threat-monitoring) ## Frequently asked questions ### What happened in the Canada Goose security breach? ShinyHunters claimed responsibility for a security attack on Canada Goose (canadagoose.com) in February 2026. The incident was first reported on February 15, 2026. ### When did the Canada Goose breach occur? The Canada Goose breach was publicly reported on February 15, 2026. ShinyHunters referenced the incident around that time, but the attack may have occurred earlier, with reports suggesting a third-party breach dating back to August 2025. ### What data was exposed? The types of data involved in the Canada Goose incident include over 600,000 customer records containing personal information, e-commerce order details, and partial payment card information. ShinyHunters has released this data in a JSON format. ### Is my personal information at risk? If you interacted with Canada Goose, there's a possibility your personal information could be affected. Similar incidents often involve email addresses, login details, or financial records. Stay alert for updates and take precautionary measures to secure your accounts. ### How can I protect myself after this data breach? * Change your account passwords immediately * Enable [multi-factor authentication (MFA) ](https://www.upguard.com/blog/mfa-multi-factor-authentication)on all sensitive accounts * Monitor your financial accounts for unauthorized activity * Be cautious of phishing emails or texts referencing your past orders * Use [data breach monitoring tools ](https://www.upguard.com/product/breach-risk/threat-monitoring)to track your information on the dark web ### What steps should companies take after being impacted by this breach? Canada Goose is investigating the claims and has stated the data appears to relate to past transactions. Companies in this position typically secure their systems, notify affected parties, provide guidance on protective actions, and review third-party security measures to prevent future incidents. ## How secure is Canada Goose ? Canada Goose manufactures and sells premium outdoor clothing and accessories, specializing in parkas, jackets, and cold-weather apparel. The company operates retail stores globally and sells products through its website and authorized retailers. * View our free preliminary report on Canada Goose ’s security posture * 13 risk factors, including email security, SSL, DNS health, open ports and common vulnerabilities [View Canada Goose 's score](/security-report/canada-goose) [View score](/security-report/canada-goose) [https://canadagoose.com](/security-report/canada-goose) ### Sign up for our newsletter UpGuard's monthly newsletter cuts through the noise and brings you what matters most: our breaking research, in-depth analysis of emerging threats, and actionable strategic insights. ## Latest news Stay up-to-date with the latest news in cybersecurity. [](/news/hugging-face-data-breach-2026-07-20) #### [Hugging Face data breach: key facts and what we know so far](/news/hugging-face-data-breach-2026-07-20) A data breach involving Hugging Face was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [UpGuard Team](/team/upguard) July 20, 2026 [](/news/ey-data-breach-2026-07-19) #### [EY data breach: what happened and what's at risk](/news/ey-data-breach-2026-07-19) A data breach involving EY was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [UpGuard Team](/team/upguard) July 15, 2026 [](/news/south-florida-injury-convenient-care-data-breach-2026-07-16) #### [South Florida Injury & Convenient Care data breach exposes names and Social Security numbers](/news/south-florida-injury-convenient-care-data-breach-2026-07-16) A data breach involving South Florida Injury & Convenient Care was reported in July 2026. See incident details, impact on customers, and security measures. ##### [UpGuard Team](/team/upguard) July 15, 2026 [](/news/park-west-psychology-data-breach-2026-07-16) #### [Park West Psychology data breach: what happened and what's at risk](/news/park-west-psychology-data-breach-2026-07-16) A data breach involving Park West Psychology was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [UpGuard Team](/team/upguard) July 15, 2026 [](/news/fall-river-municipal-credit-union-data-breach-2026-07-16) #### [Fall River Municipal Credit Union data breach: what happened and what's at risk](/news/fall-river-municipal-credit-union-data-breach-2026-07-16) A data breach involving Fall River Municipal Credit Union was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [](#) July 14, 2026 [](/news/npcil-data-breach-2026-07-16) #### [NPCIL data breach: World Leaks claims exposure of Kudankulam Nuclear Power Plant files](/news/npcil-data-breach-2026-07-16) A data breach involving NPCIL was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [UpGuard Team](/team/upguard) July 14, 2026 [View all news](/news) ## Protect your organization Get in touch or book a free demo. [Contact sales](/demo) [Free demo](/demo) ##### Free instant security score ## How secure is your organization? Request a free cybersecurity report to discover key risks on your website, email, network, and brand. * Instant insights you can act on immediately * Hundreds of risk factors including email security, SSL, DNS health, open ports and common vulnerabilities [Free score](/instant-security-score)