Threat watch / Breach
Who Gives A Crap: customer data accessed through a marketing software provider
The Australian toilet paper brand Who Gives A Crap told customers in Australia, the US and the UK that their personal information "was accessed without authorisation" in a security incident at one of its marketing software providers. Names, contact details, postal addresses and total spend are involved; payment details, order details and passwords are not. The company has not given a number of customers.
- Sector
- Retail
- Way in
- Supplier
- Product or vendor
- None named
- How it happened
- A security incident at an unnamed US-based marketing software provider, which informed Who Gives A Crap on November 6. The company has disconnected the provider from its customer systems and changed access credentials. How the provider was breached is not public.[1][2] Checked 9 Nov 2026
- What was stolen
- First and last names, email addresses, phone numbers, postal addresses and the total amount each customer has spent, according to the CEO's email. It "did not include payment details, order details or passwords". The CEO says: "We don't yet know whether the information was copied or downloaded."[1][2] Checked 9 Nov 2026
- Who was impacted
- Customers in Australia, the US and the UK; the company says Canadian customer data was not touched. It has not published a number of affected customers.[1][2] Checked 9 Nov 2026
- Threat actor
- Not attributed
Timeline
- The unauthorized access at the marketing software provider begins, according to the company. [1][2]
- The access is detected, a day after it began. [1][2]
- The affected systems are secured. [1][2]
- The provider informs Who Gives A Crap of the incident. [1]
- CEO Simon Griffiths emails customers. The company says it will engage "with the relevant regulatory authorities, as required" and has seen "no evidence of misuse at this point". No group has claimed the attack. [1][2]