Full Report
In mid-2026, hundreds of thousands of user records allegedly sourced from Golf Canada began circulating via Telegram. The data included 569k unique email addresses along with names, usernames, dates of birth, genders and approximate geographic locations (city, province and postcode). Golf Canada didn't respond to multiple attempts to make contact, and it remains unclear whether the data was obtained via unintentionally exposed website features or a security vulnerability.
Analysis Summary
# Incident Report: Golf Canada Data Leak
## Executive Summary
In mid-2026, a significant data leak involving Golf Canada surfaced when records for 569,000 unique users began circulating on Telegram. The compromised data included personally identifiable information (PII) such as names, birth dates, and geographic locations. The organization has not officially acknowledged the incident, leaving the exact technical root cause—whether a vulnerability or an exposed API—unconfirmed.
## Incident Details
- **Discovery Date:** August 22, 2026 (Date added to HIBP)
- **Incident Date:** May 2026
- **Affected Organization:** Golf Canada
- **Sector:** Sports / Non-profit
- **Geography:** Canada
## Timeline of Events
### Initial Access
- **Date/Time:** May 2026
- **Vector:** Unknown (Suspected unintentionally exposed website features or security vulnerability)
- **Details:** Attackers likely exploited a web-facing asset to scrape or dump user database records.
### Lateral Movement
- **Details:** Not disclosed; evidence suggests direct database access or API exploitation rather than deep network penetration.
### Data Exfiltration/Impact
- **Details:** 569,000 unique records were exfiltrated. The data began circulating on the Telegram messaging platform in mid-2026.
### Detection & Response
- **How it was discovered:** Third-party monitoring of Telegram channels and subsequent indexing by Have I Been Pwned.
- **Response actions taken:** Golf Canada did not respond to multiple contact attempts; no public remediation has been disclosed by the organization.
## Attack Methodology
- **Initial Access:** Likely exploitation of a vulnerable web application or an unsecured API endpoint.
- **Persistence:** Unknown.
- **Privilege Escalation:** Unknown.
- **Defense Evasion:** Likely performed via standard web requests to avoid triggering basic rate-limiting (if scraping occurred).
- **Credential Access:** No passwords reported; focus was on PII collection.
- **Discovery:** Possible reconnaissance of Golf Canada’s public web infrastructure.
- **Lateral Movement:** N/A.
- **Collection:** Automated extraction of user profiles.
- **Exfiltration:** Data transferred to external servers and distributed via Telegram.
- **Impact:** Mass data exposure of 569k users.
## Impact Assessment
- **Financial:** Potential regulatory fines under Canadian privacy laws (PIPEDA); costs associated with future credit monitoring for victims.
- **Data Breach:** High volume of PII (569,000 records).
- **Operational:** Minimal reported disruption to services.
- **Reputational:** High; lack of transparency and failure to respond to security inquiries may damage member trust.
## Indicators of Compromise
- **Network indicators:** None disclosed.
- **File indicators:** Database export files circulating on Telegram (Golf_Canada_Users.csv or similar).
- **Behavioral indicators:** Abnormal traffic patterns on web-facing user profile pages or API endpoints in May 2026.
## Response Actions
- **Containment measures:** None confirmed by the organization.
- **Eradication steps:** None confirmed.
- **Recovery actions:** Data was added to breach notification services (HIBP) to alert affected users.
## Lessons Learned
- **Key takeaways:** Silent data leaks via Telegram are becoming a primary method for data distribution.
- **What could have been done better:** Golf Canada should have established a clear security disclosure channel (security.txt) and responded to breach notifications to coordinate a controlled disclosure.
## Recommendations
- **API Security:** Implement strict rate-limiting and authentication requirements for all public-facing APIs and user search features.
- **Data Minimization:** Review the necessity of storing dates of birth and precise geographic data if not essential for operations.
- **Monitoring:** Deploy web application firewalls (WAF) and monitor for mass egress of data from user-facing databases.
- **Incident Response Planning:** Develop a communication strategy for responding to third-party researchers and breach notifications.