ShinyHunters, a well known knowledge extortion group, claims to have stolen greater than 600,000 Canada Goose buyer data containing private and payment-related knowledge.
Canada Goose advised BleepingComputer the dataset seems to narrate to previous buyer transactions and that it has not discovered proof of a breach of its personal methods.
Based in 1957, Canada Goose is a Toronto-based efficiency luxurious outerwear model with a world retail footprint and almost 4,000 workers.
Canada Goose sees no proof of breach
“Canada Goose is conscious {that a} historic dataset regarding previous buyer transactions has not too long ago been revealed on-line,” the corporate advised BleepingComputer.
“At the moment, we’ve got no indication of any breach of our personal methods. We’re at the moment reviewing the newly launched dataset to evaluate its accuracy and scope and can take any additional steps as could also be acceptable. To be clear, our overview exhibits no proof that unmasked monetary knowledge was concerned. Canada Goose stays dedicated to defending buyer info.”
1.67 GB dataset comprises detailed order data
ShinyHunters added Canada Goose to its knowledge leak website this week, claiming the archive comprises greater than 600,000 buyer data.
(BleepingComputer)
Samples reviewed by BleepingComputer present that the 1.67 GB dataset, launched in JSON format, comprises detailed e-commerce order data, together with buyer names, e-mail addresses, telephone numbers, billing and delivery addresses, IP addresses, and order histories.
The information additionally contains partial cost card info reminiscent of card model, the final 4 digits of card numbers, and in some instances the primary six digits (BIN), together with cost authorization metadata.
Whereas the dataset doesn’t seem to comprise full cost card numbers, the uncovered info may nonetheless be used for focused phishing, social engineering, and fraud.
The data additionally embody buy historical past, machine and browser info, and order values, probably permitting attackers to profile high-value prospects.
Hackers deny hyperlink to latest SSO assaults
ShinyHunters has not too long ago been linked to a wave of social-engineering assaults concentrating on single sign-on (SSO) accounts and cloud environments.
When requested whether or not the Canada Goose knowledge was obtained by means of these intrusions, the group advised BleepingComputer the dataset was unrelated, claiming it originated from a third-party cost processor breach and dates again to August 2025.
BleepingComputer has not independently verified the declare.
The dataset’s schema (particularly, subject names like checkout_id, shipping_lines, cart_token, cancel_reason, and so on.), nevertheless, carefully resembles e-commerce checkout exports generally related to hosted storefront and cost processing platforms, which can assist clarify how the information may have originated from a third-party service supplier.
Who’s ShinyHunters?
ShinyHunters is a prolific knowledge extortion group recognized for stealing and leaking massive volumes of buyer knowledge from main manufacturers and on-line providers.
The group has been linked to quite a few high-profile breaches and knowledge theft incidents in recent times, typically concentrating on e-commerce platforms, SaaS providers, and cloud environments.
In latest reporting, safety researchers have tied the group to vishing and social-engineering campaigns used to achieve entry to company accounts and cloud knowledge.
Stolen knowledge is usually used for extortion, bought on underground boards, or revealed on the group’s leak website when victims refuse to pay.
It isn’t but recognized what number of Canada Goose prospects could also be affected or whether or not people will probably be notified. The corporate says it’s persevering with to overview the dataset to find out its accuracy and scope.
Trendy IT infrastructure strikes quicker than handbook workflows can deal with.
On this new Tines information, find out how your crew can scale back hidden handbook delays, enhance reliability by means of automated response, and construct and scale clever workflows on high of instruments you already use.
