Loading story…
Goose Creek Candle Company is facing a reported data breach after an unknown party emailed some customers claiming the retailer had a security vulnerability and that its data had been compromised. The exposed dataset was later submitted to Have I Been Pwned, which listed the incident as affecting approximately 6.6 million unique email addresses tied to Goose Creek customer records.
The leaked information reportedly includes names, phone numbers, physical addresses, order IDs, and purchase-related details such as total spent. Reporting indicates the data appears to have been obtained from Goose Creek’s Shopify instance. Goose Creek acknowledged awareness of the reports, but no additional details had been provided to Have I Been Pwned at the time of publication.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
Goose Creek Candle Company acknowledged that it was aware of the reports about the incident, but had not provided Have I Been Pwned with additional information at the time of publication.
The exposed dataset was later provided to Have I Been Pwned and reportedly contained about 6.6 million unique email addresses, plus names, phone numbers, physical addresses, order IDs, and total-spent or purchase-related information. The data appears to have been obtained from Goose Creek Candle Company's Shopify instance.
In June 2026, a party claiming to have access to Goose Creek Candle Company data emailed a number of the company's customers, alleging the company had a security vulnerability and had suffered a data breach.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**ShinyHunters** published a **1.67 GB** dataset allegedly containing **600,000+ Canada Goose customer records** on its data leak site, positioning the release as stolen e-commerce data tied to customer orders. Canada Goose said it is aware of the publication of a *historical dataset* related to past transactions and stated it has **no indication of a breach of its own systems**, while it continues to review the dataset’s accuracy and scope and determine whether customer notifications are required. Samples reviewed indicate the leak contains detailed order and customer information, including **names, email addresses, phone numbers, billing/shipping addresses, IP addresses, order histories/values, and device/browser details**, along with **partial payment card data** (e.g., card brand, last four digits, and in some cases **BIN/first six digits**) plus payment authorization metadata. Canada Goose stated its review shows **no evidence of unmasked financial data** being involved, but the exposed personal and transaction context could still enable **targeted phishing, social engineering, and fraud** against affected customers.
Jun 29, 2026
**Canadian Tire Corporation** disclosed a major breach of its **e-commerce customer database** after identifying unauthorized access on **October 2, 2025**, exposing personal data tied to **38+ million customer accounts**. Exposed data included names, physical addresses, email addresses, year of birth (and for **<150,000** accounts, full dates of birth), and **encrypted passwords**; some records also contained **truncated payment card numbers**. The company stated the exposed financial data could not be used to conduct transactions, and reported **no impact** to in-store systems, *Canadian Tire Bank*, or *Triangle Rewards*. Canadian Tire reported it **remediated the underlying issue**, notified regulators, and planned customer notifications and **credit monitoring**. *Have I Been Pwned* added the incident to its corpus, reporting roughly **42 million records** (including **~38.3 million email addresses**) and indicating the dataset includes **PBKDF2 password hashes** along with additional fields such as phone numbers and gender, increasing the likelihood of credential-stuffing and identity-fraud follow-on activity.
Jun 29, 2026
Attackers compromised API credentials for the third-party **Ribon** and **Ribon 1.5** applications, operated by Be A Part Of, a Fastr company, and used them to access customer records in BigCommerce merchant environments. Between September 13 and 17, they also injected malicious scripts into a small number of storefronts; reported exposed data included customer names, email addresses, phone numbers, and shipping or physical addresses. BigCommerce said its core platform and systems were not breached and that passwords and payment-card data were not exposed. The company disabled the compromised credentials, removed the affected apps from impacted stores, revoked attacker access, notified merchants, and provided logs to support the application developer's investigation.
Sep 23, 2026