Canada Goose canadagoose.com Canada Goose data breach: what happened and what to do
In February 2026, data on Canada Goose customers was published publicly. It covers 581,877 accounts and includes names, email addresses, phone numbers, physical addresses and partial card data (type and last 4 digits). Canada Goose says it came from a third party.
View all 13,115 breaches- Breach date
- 4 Jul 2025
- Affected
- 581,877
- Data exposed
- Device information, Email addresses, IP addresses, Names, Partial credit card data, Phone numbers, Physical addresses, Purchases
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
In February 2026, a dataset said to hold Canada Goose customer data was published publicly. Have I Been Pwned added it on February 17, 2026 and counts 581,877 accounts, from 920k records.
What happened
The data includes the most recent transaction dates up to July 2025. Canada Goose said the data appears to relate to past customer transactions and that it originated from a breach at a third party in August 2025. Reporting at the time said the hackers behind the leak claimed it came from a payment processor, while the company said its own systems showed no sign of compromise.
Have I Been Pwned lists the breach date as July 4, 2025.
What was exposed
The records contain names, email addresses, phone numbers, physical addresses and IP addresses. They also include device information, purchases and partial credit card data: only the card type and the last 4 digits, not full card numbers.
That mix is useful to scammers. A text or email that knows your name, your address and that you bought a coat from Canada Goose can pass for a real order or delivery message. The last 4 digits of a card help a caller sound like your bank.
The address and phone number don't change when you reset a password, so the risk lasts longer than with a leaked login.
What the company said
Canada Goose described the data as past transactions from a third party and said no unmasked financial data was involved. Its statement didn't say how many customers were affected.
What to do if you were in it
- 1
Expect order and delivery scams
Be suspicious of texts or emails about a Canada Goose order, refund or delivery that you didn't expect. Don't click the links. Contact the retailer through its own site.
- 2
Treat calls that quote your card's last 4 digits with caution
A caller who knows the last 4 digits isn't proof of who they are. Hang up and call the number on the back of your card.
- 3
Watch your card statements
Full card numbers weren't in the data, but check recent statements and report charges you don't recognize.
- 4
Watch for phishing on your phone number and address
Smishing (scam texts) often reuses details from leaks. Delete unexpected texts and block the sender.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It looks for your email and phone number in known breaches and tells you which ones you appear in, so you know what to change.
Frequently asked
Was I affected by the Canada Goose data breach?
If you bought from Canada Goose before mid-2025, your email may be among the 581,877 accounts. Check at Have I Been Pwned or run a free Serus scan.
Were full credit card numbers leaked?
No. The data contains the card type and the last 4 digits only.
Did the breach happen at Canada Goose?
The company says the data came from a breach at a third party in August 2025 and that its own systems showed no sign of compromise.
Should I change my password?
Passwords weren't listed in the exposed data, so it isn't required. Changing it if you reuse it elsewhere is still sensible.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
