Canada Goose Data Breach (2025)

On February 4, 2026, a dataset containing information on 582,000 unique Canada Goose customers appeared on a public leak site. The files, totaling roughly 920,000 records, include names, email addresses, phone numbers, physical addresses, IP addresses, device details, purchase history, and partial credit card data showing only the card type and last four digits. Canada Goose has stated the information appears to relate to past customer transactions and originated from a breach at a third-party vendor in August 2025, with the most recent transaction date in the exposed data being July 2025.

What Public Reporting Shows

Public reporting indicates the dataset was published in early February 2026. It contains 582,000 unique email addresses along with corresponding personal details. Canada Goose confirmed that the compromised records stem from customer transactions processed through a third-party supplier breached in August 2025. The company has emphasized that no evidence suggests the breach occurred directly on its own systems. Available reporting describes the exposed payment information as limited to card type and last four digits rather than full card numbers.

Why This Matters for You and Your Family

If you have ever bought a Canada Goose jacket, parka, or any other product from the company, your name, home address, phone number, and email address may now be circulating among criminals. This combination of data makes it easier for scammers to craft convincing phishing emails or phone calls that reference a specific purchase or delivery address. For families, the risk extends beyond the primary shopper: children’s names sometimes appear in family orders, and shared household addresses link everyone living there. Once your information is public, it rarely disappears on its own.

Partial credit card data may seem harmless, but paired with names and addresses it can support identity theft attempts or fraudulent orders placed in your name. The presence of IP addresses and device information further narrows the target profile, allowing attackers to correlate this breach with other leaks.

The Doxxing and Identity-Chain Implications

Names, addresses, and phone numbers serve as anchor points that attackers use to connect disparate online accounts. A single leaked purchase record can be chained with gaming usernames, social media handles, or school email addresses belonging to your children. These linkages create detailed profiles that fuel harassment, swatting, or targeted extortion. Credential leaks of this nature frequently cascade into account takeovers on shopping sites, email services, and gaming platforms where the same password was reused.

What to Do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real-world identity, then use the included cleanup of data broker records tied to the Canada Goose breach.
• Rotate the password you used at Canada Goose or the affected third-party vendor anywhere it is reused, and switch on two-factor authentication through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1 billion+ breach records and more than 100 platforms so the next exposure of your family’s information is flagged within hours instead of months.
• Cover the entire household with DoxxScan family protection, which extends to dependents and children’s gaming accounts that often chain back to the same home address or parent email.
• Let DoxxScan remediation specialists handle takedown requests and opt-out processes across data brokers and people-search sites on your behalf.

The incident demonstrates how a single vendor breach can quietly expose hundreds of thousands of ordinary customers years after the original transaction. Acting quickly on the exposed data gives you the best chance of limiting further spread. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping that links handles to real identities, hands-on remediation by specialists, and full household coverage including children’s gaming accounts that are frequently targeted once a family address is known. Because credential leaks like the Canada Goose incident routinely cascade into account takeovers and doxxing chains, the service is especially useful for protecting both adult and children’s gaming profiles that share household information.