Golf Canada Data Breach: 569k User Records Allegedly Leaked via Telegram
In mid-2026, user records allegedly taken from Golf Canada began circulating on Telegram, and Have I Been Pwned added them to its database on 22 Aug 2026. The dataset covers 569k unique email addresses with names, usernames, dates of birth, genders and approximate locations (city, province, postcode). The breach is dated May 2026. It is unclear whether the data came from unintentionally exposed website features or from a security vulnerability. No threat actor has been named.
Technical Details
- Breach occurred: May 2026; added to HIBP: 22 Aug 2026.
- Exposed data: email addresses, names, usernames, dates of birth, genders, geographic location (city, province, postcode).
- Distribution channel: Telegram.
- Root cause and access vector are unconfirmed (exposed website features or a vulnerability).
Remediation
- Affected users should change passwords on any account that reused the exposed one, and use a password manager to create unique passwords.
- Enable 2FA wherever it is supported.
- Expect targeted phishing that uses the exposed personal and location data.
Linha do tempo
-
Golf Canada Data Breach: 569k User Records Allegedly Leaked via Telegram
ler a análise desta fonte ocultar
In mid-2026, user records allegedly taken from Golf Canada began circulating on Telegram, and Have I Been Pwned added them to its database on 22 Aug 2026. The dataset covers 569k unique email addresses with names, usernames, dates of birth, genders and approximate locations (city, province, postcode). The breach is dated May 2026. It is unclear whether the data came from unintentionally exposed website features or from a security vulnerability. No threat actor has been named.
Technical Details
- Breach occurred: May 2026; added to HIBP: 22 Aug 2026.
- Exposed data: email addresses, names, usernames, dates of birth, genders, geographic location (city, province, postcode).
- Distribution channel: Telegram.
- Root cause and access vector are unconfirmed (exposed website features or a vulnerability).
Remediation
- Affected users should change passwords on any account that reused the exposed one, and use a password manager to create unique passwords.
- Enable 2FA wherever it is supported.
- Expect targeted phishing that uses the exposed personal and location data.