Canada Goose Listed by shinyhunters Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On February 24, 2026, the ransomware group shinyhunters listed Canada Goose on its leak site, claiming to have obtained internal files from the company. The number of people affected remains unknown, and no confirmation of the data’s authenticity or scope has been made public.

The incident matters because any exposure of internal records from a company that handles customer transactions can create downstream risks for individuals whose information appears in those files, even when the precise contents stay undisclosed.

Breaking down the breach

The only confirmed public detail is the listing itself, reported on February 24, 2026, with an update noted on February 15, 2026. No information has been released about how many files were taken, when the access occurred, or whether any data was later published or sold.

The description attached to the listing refers to internal files exfiltrated during a ransomware attack. Beyond that statement, technical details such as the initial access method, duration of access, or encryption status have not been disclosed.

The group behind it: shinyhunters

Shinyhunters is a ransomware operator that has repeatedly used leak-site listings to pressure organizations. The group’s pattern involves claiming possession of stolen data and threatening to release portions of it if demands are not met.

The Canada Goose entry follows this established approach. The group claims responsibility for the exfiltration, but no independent verification of that claim has been published by the company or by investigators.

Who is Canada Goose?

Canada Goose designs and sells winter apparel and related products through retail stores and an online platform. Like other retailers in this sector, the company processes customer orders, manages loyalty programs, and maintains internal systems that contain operational and transactional records.

A listing involving internal files is consequential because such records often include details generated during normal business operations, even when the exact categories remain unspecified.

What was likely exposed

The listing states that internal files were exfiltrated. No further breakdown of file types or data fields has been provided.

Organizations of this kind routinely store customer identifiers, order histories, and contact information as part of day-to-day operations. Whether any of those categories appear in the claimed files is unconfirmed.

The real-world impact

Individuals whose information is present in the exfiltrated files could face follow-on attempts at fraud or targeted phishing, depending on the data elements involved. The absence of a confirmed record count makes it impossible to gauge the scale of that exposure.

For the organization, the listing adds to the operational burden of investigating the incident, notifying regulators where required, and responding to customer inquiries, regardless of whether the claimed data is later shown to be limited or fabricated.

Were you affected?

If you have interacted with Canada Goose through purchases or accounts, monitor your email and financial statements for unusual activity. Enable multi-factor authentication on any associated accounts and consider requesting a credit report if payment details were supplied in the past.

Readers can run a free exposure scan of their email address against known breach data to check for appearances in previously published datasets. No public mechanism has yet been announced for confirming presence in this specific incident.

AICompiled with AI assistance from public sources and published under our editorial standards.