Goose Creek goosecreek.com Goose Creek data breach: what happened and what to do
In June 2026, customers of Goose Creek Candle Company received emails from a party claiming a data breach. Have I Been Pwned counts 6.6 million email addresses, with names, phone numbers, physical addresses and order details. The company hasn't confirmed what happened.
View all 13,115 breaches- Breach date
- 9 Jun 2026
- Affected
- 6,574,121
- Data exposed
- Email addresses, Names, Phone numbers, Physical addresses, Purchases
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In June 2026, an unknown sender emailed a number of Goose Creek Candle Company customers. The message said the company had a security vulnerability and had suffered a data breach, and it quoted each recipient's own name, address, phone number and order number to prove the claim, according to reporting on the incident.
The data was later sent to Have I Been Pwned. Its analysis says the data appears to have been taken from the company's Shopify store. Goose Creek said it was aware of the reports but could not give Have I Been Pwned any more information when the entry was published.
How many people
Have I Been Pwned counted 6,574,121 unique email addresses, about 6.6 million. That is a count of email addresses, not necessarily of separate customers.
What was exposed
Have I Been Pwned lists email addresses, names, phone numbers, physical addresses and purchases. In practice, that means order IDs and the total spent on an order. Techlicious reports that passwords and payment card numbers do not appear to be part of the data.
What that lets criminals do
The sender of the original emails proved the data is real by quoting it back to customers. Anyone holding this data can write to you with your real order number, your address and what you spent. That makes fake shipping notices, refund offers and "problem with your order" emails far more convincing than usual.
A phone number and address also support text scams and calls that sound as if they come from a store you actually use. There's no password in the data, so the main risk is being tricked into handing something over, not an account being taken over.
The company's response
Goose Creek has not published a breach notice, and it has not confirmed how the data left its systems. If you received one of the original emails, don't reply to it and don't click anything in it. Contact the company through its own website to ask what it knows.
Why a store breach still matters
Online stores are a favorite target because they hold a lot of contact details and little else worth protecting well. Even without a password or card number, a list of 6.6 million buyers with their addresses and order history is valuable to scammers, and it can be resold and combined with data from other breaches for years.
If you ordered from Goose Creek
Customers of an online store tend to forget which shops hold their details. If you have ordered from Goose Creek Candle Company, assume your order history may be in the data. Search your email on Have I Been Pwned, and treat any message about a Goose Creek order with care until you've checked it on the company's own site.
What to do if you were in it
- 1
Don't reply to or click the original emails
If you received a message claiming a Goose Creek breach, treat it as hostile. Don't answer it, and don't open links or attachments. Mark it as phishing.
- 2
Verify any order message on the store's site
Real order numbers and amounts are in the data, so a fake message can look right. Log in at the company's own website, or contact it there, instead of using a link.
- 3
Be careful with unexpected calls and texts
Your phone number and address leaked. Don't give out card details or verification codes to anyone who contacts you first.
- 4
Use a separate email for shops
An alias or a dedicated shopping address makes it easier to spot which store a scam message really came from.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your data appears. It can't take data out of a breach, but it shows you what leaked and what to do about it.
Frequently asked
Was I affected by the Goose Creek breach?
If you ordered from Goose Creek Candle Company online, you may be. Search your email on Have I Been Pwned, which holds 6.6 million email addresses from the data.
What was exposed?
Have I Been Pwned lists email addresses, names, phone numbers, physical addresses and purchase details such as order IDs and total spent.
Were payment cards exposed?
Reporting says payment card numbers and passwords do not appear to be in the data. Check your statements anyway, and report anything unfamiliar to your card issuer.
Has Goose Creek confirmed the breach?
Not publicly. The company said it was aware of the reports but could not give Have I Been Pwned further information when the entry was added.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
