If You Shopped at Canada Goose, Check This 579,620-Record Leak

If you've ever placed an order with Canada Goose, HEROIC analysts found a data breach dated February 2026 that may concern you. The incident exposed 579,620 records, including email addresses, names, phone numbers, and IP addresses. Scanning your email is the fastest way to see whether your own account details ended up in this exposure.

Why This Is Dangerous

The combination of a real name, phone number, and IP address gives scammers enough to build a convincing pretext, even without a stolen password. An IP address can also hint at a person's general location and habits, adding another layer that makes an impersonation attempt feel more credible. Because this incident is marked sensitive, the exposure deserves extra caution rather than a quick dismissal.

What Was Exposed

• Email Address
• First Name
• Last Name
• Phone Number
• IP Address

In practice, this kind of data tends to fuel phishing messages that reference a person's real name and order history, tricking recipients into clicking a link or confirming account details. Some victims receive calls posing as customer support, using the leaked phone number as the first point of contact. Combined with other leaks over time, this information can also feed broader identity theft schemes.

A breach like this happens when records are taken from wherever a business stores its customer data, rather than being harvested from individual devices or assembled from scattered online lists. That places the exposure at the level of stored business records, not personal password habits. Once records like these are removed, they tend to circulate well beyond the reach of whoever originally held them.

Check Whether You Were Affected

Scan your email to see if your details are part of this exposure.

• Be wary of unexpected calls, texts, or emails referencing your name, order history, or contact details.
• Avoid clicking links in unsolicited messages that claim to be from Canada Goose or related services.

This applies whether the affected email is personal or one you use for work.