July 15, 2026: Have I Been Pwned added Goose Creek Candle Company after a dataset with 6.6 million unique email addresses surfaced following customer reports in June 2026. The load includes names, phone numbers, physical addresses, order IDs, and lifetime spend — fields consistent with a Shopify e-commerce export.
What customers saw in June
Some Goose Creek shoppers received emails from an outside party claiming the candle retailer had a security vulnerability and had been breached. Those messages were not standard corporate breach letters; they came from whoever held the data and wanted attention before the dump spread.
Goose Creek told HIBP it was aware of the reports but could not provide additional corporate detail at publication time. That gap is common when a load arrives through researchers or intermediaries before legal and PR teams finish a formal notice.
What the HIBP load contains
- 6.6M unique email addresses
- Names and phone numbers
- Physical mailing addresses
- Order IDs and total spent (purchase history metadata)
For a candle and home-fragrance brand with a large repeat-customer base, order totals plus addresses are enough to power convincing “your Goose Creek order failed — click to fix payment” scams even without passwords.
The 84% overlap stat
HIBP operator Troy Hunt noted that roughly 84% of the Goose Creek emails already appeared in earlier breaches in the HIBP corpus. That does not make this leak harmless — it means many accounts were already exposed elsewhere, which increases cross-site password-reuse risk for the remaining 16% and refreshes shipping addresses attackers may not have had from older dumps.
Action items
- Check haveibeenpwned.com for your email.
- Change your Goose Creek password and any site where you reused it.
- Ignore refund or payment-fix links in unsolicited texts or emails citing order numbers.
- Watch for package-delivery and gift-card scams using your real name and address.
Canonical record: Goose Creek 2026 on BreachHistory.