Canada Goose data breach: 581K accounts exposed
Severity: high · Patch status: no-fix-needed · Since 2026-02-17
In February 2026, a data breach allegedly containing data relating to Canada Goose customers was published publicly. The data contained 920k records with 582k unique email addresses and included names, phone numbers, IP addresses, physical addresses and partial credit card data, specifically card type and last 4 digits. Canada Goose advised that the data "appears to relate to past customer transactions" and stated that it originated from a breach at a third party in August 2025. The most recent transaction date in the data is July 2025. Exposed data: device information, email addresses, ip addresses, names, partial credit card data, phone numbers, physical addresses, purchases. The breach dates from Jul 4, 2025; Have I Been Pwned loaded it on Feb 17, 2026.
What to do
- If you had a Canada Goose account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
