Golf Canada data breach
568,972 accounts exposed in a breach on 14 May 2026.
At a glance
568,972
Accounts exposed
14 May 2026
Date of the breach
22 August 2026
Added to the list
What happened
In mid-2026, hundreds of thousands of user records allegedly sourced from Golf Canada began circulating via Telegram. The data included 569k unique email addresses along with names, usernames, dates of birth, genders and approximate geographic locations (city, province and postcode). It remains unclear whether the data was obtained via unintentionally exposed website features or a security vulnera
What was exposed
- Dates of birth. Dates of birth were exposed. They help criminals prove they are you, and they cannot be changed.
- Email addresses. Email addresses were exposed. Expect more spam and phishing aimed at those addresses.
- Genders. Genders were exposed. On its own it is low risk, but it adds to a profile of you.
- Geographic locations. General locations were exposed. They add to a profile of you.
- Names. Names were exposed. Scammers use real names to make a message look personal.
- Usernames. Usernames were exposed. Together with a reused password they open accounts.
What to do now
It depends on what was exposed, so these steps follow the list above.
If your contact details were exposed
- Expect more spam, scam calls and phishing. Do not click links or open attachments in messages you did not expect.
- If a message mentions this breach, do not reply. Go to the organisation's own website or app instead of using a link in the message.
Whatever was exposed
- Check which other breaches include your own email address and phone number.
- Keep an eye on your accounts for a few months. Breached data is often used long after the breach.
- If you think someone is using your details, report it to the organisation and to your national cyber crime reporting service.
Check your own exposure
- Password leak check: find out whether a password has appeared in a breach. The password never leaves your browser.
- Free domain security scan: grade the email, DNS and website security of a domain you own.
Related breaches
Other breaches that exposed some of the same kinds of data.
University of Nottingham
In June 2026, the University of Nottingham was the target of a cyber attack, later linked to a ShinyHunters "pay or leak" extortion campaign.
- Academic records
- Citizenship statuses
- Dates of birth
- Disabilities
- +11 more
Read what happened
Carnival
In April 2026, the notorious hacking collective ShinyHunters claimed they had obtained a substantial volume of data belonging to the Carnival cruise operator and…
- Dates of birth
- Email addresses
- Genders
- Geographic locations
- +3 more
Read what happened
Sharecare
In August 2026, the digital health company Sharecare was the target of a ShinyHunters "pay or leak" extortion campaign.
- Dates of birth
- Email addresses
- Employers
- Genders
- +6 more
Read what happened