Science & Tech · Cybersecurity · 3 hrs ago
Who Gives A Crap customer data exposed in third-party breach
An intruder accessed Who Gives A Crap customer information through a software provider used by the toilet paper company.
The breach affected customers in Australia, the UK and the US, while the company says Canadian customers were not affected.
The exposed details included names, contact information, mailing addresses and total spending with the company.
Payment information, order details and passwords were not exposed, and customer accounts were not directly accessed.
The company says it does not know whether the intruder copied or downloaded the information, and it has found no evidence of misuse.
Who Gives A Crap disconnected the provider and changed access credentials after learning of the breach.
It is warning affected customers to watch for scam messages that use their real details, while the UK regulator assesses the incident.
An intruder accessed customer information held by a third-party marketing software provider used by Who Gives A Crap.
The company said customers in Australia, the UK and the US were affected, while no Canadian customer information was accessed.
Exposed information included names, email addresses, phone numbers, mailing addresses and total spending with the company.
Payment information, order details and passwords were not involved, and customer accounts were not directly accessed.
Who Gives A Crap said it had found no evidence of misuse but did not know whether the information had been copied or downloaded.
- Who
- Who Gives A Crap customers in Australia, the UK and the US were affected.
- What
- An intruder accessed customer information through a third-party marketing software provider.
- When
- The supplier said the intrusion began on October 30, 2026. Who Gives A Crap was notified on November 6.
- Where
- The incident was at an unnamed US-based marketing software provider and affected customers in Australia, the UK and the US.
- Why
- Not stated
This story does not have two clearly opposing sides.
The intruder gained access to the marketing software provider's systems.
The provider spotted the intrusion.
The provider said it had secured its systems.
Who Gives A Crap was notified of the incident.
- Affected countries
- Australia, the UK and the US
- Provider location
- United States
- Exposed information
- Names, email addresses, phone numbers, mailing addresses and total spending
- Unaffected data
- Payment information, order details and passwords were not involved
- Canadian customers
- No personal information was accessed
- Supplier notification
- Who Gives A Crap was told on November 6
What people are saying
We don't yet know whether the information was copied or downloaded
The main concern is scam or phishing messages that use your real details to look convincing
We can confirm Who Gives A Crap Limited has reported an incident and we are assessing the information provided.