Who Gives A Crap Data Breach: Customer Details Accessed at a Marketing Software Vendor, What Is Confirmed and What Businesses Should Check
Who Gives A Crap says names, contact details and spending totals were accessed at a US-based marketing software provider. Here is what is confirmed, what is not known, and what to check with your own vendors this week.
Where Australia, United Kingdom, United States · Europe, Northern Europe, North America, United States & Canada, Oceania, Australia & New Zealand
On this page 7 sections
Who Gives A Crap, the Australian seller of recycled toilet paper, tissues and kitchen towels, says customer names, email addresses, phone numbers, mailing addresses and spending totals were accessed without authorization at an outside marketing software provider. If your business sends customer lists to a marketing tool, you carry the same exposure: a vendor you chose can be breached, and the apology to your customers still comes from you.
A note on sourcing. ABC News says the company posted a statement on its website, and Cyber Daily refers to a public disclosure page, but we could not open that page ourselves. The Australian and US home pages we checked on November 8 showed no banner or link to it. The details below come from those two outlets, which quote the company's statement and its CEO's email to customers.
What happened in the Who Gives A Crap data breach
The company began emailing customers on Saturday, November 7, in a message from CEO Simon Griffiths. ABC News and Cyber Daily both reported it on November 8. The provider is described only as a US-based marketing software company, and it has not been named.
The reported timeline:
| Date (2026) | What is reported |
|---|---|
| October 30 | Unauthorized access began |
| October 31 | The access was identified |
| November 1 | The affected systems were secured |
| Friday, November 6 | The provider told Who Gives A Crap |
| Saturday, November 7 | Customer emails started going out |
By that timeline, seven days passed between the first access and the company being told. It then notified customers the next day.
The company says it disconnected the provider from its systems, changed access credentials, and is working with the provider to determine whether further action is needed.
What data was exposed, and what was not
According to the company, the information involved was:
- First and last name
- Email address
- Phone number
- Mailing address
- The total amount the customer has spent with the company
The company says the data did not include payment details, order details or passwords, and that customer accounts were not directly accessed.
What is confirmed and what is not known
Everything here is the company's own account, as reported by two news outlets. We found no independent technical report, and the provider has not spoken publicly under its own name.
What the company says:
- Systems holding information from its Australian, UK and US stores were breached.
- Canadian customer data was not accessed. Cyber Daily puts it more cautiously, saying that data appears unaffected.
- It has "no evidence of misuse so far."
- It will engage with the relevant regulatory authorities as required.
What is not known:
- How many customers are affected. Neither report gives a number.
- Which provider was involved. Treat any name you see as a guess until the company or the provider confirms it.
- Whether the data was taken. Griffiths wrote: "We don't yet know whether the information was copied or downloaded."
- How the intruder got in.
- Who did it. As of Cyber Daily's report, no threat actor had claimed responsibility.
- Which regulators have been contacted.
That third point matters. "Accessed" is not the same as "stolen," and the company has not said the data left the provider's systems. It also has not ruled that out.
Why a third-party data breach matters for your business
This is the part that applies well beyond one consumer brand. Marketing platforms tend to hold exactly what this incident involved: who your customers are, how to reach them, and how much they spend. That data sits outside your firewall, under someone else's logins and someone else's security program.
The U.S. Cybersecurity and Infrastructure Security Agency makes the same point in its supply chain guidance, noting that threats can reach organizations through contractors, subcontractors and suppliers at all tiers.
Three things stand out in our reading of this case:
- Your clock can start late. You can only respond once you know. In this case the company was told five days after the systems were reported secured.
- Spending totals make scams more believable. This is our assessment, not something reported as happening. A fake message that knows your name, your address and roughly what you spend is harder to dismiss than a generic one.
- Disconnecting has to be quick. The company says it cut the provider off. Many businesses would need to work out how to do that during the incident itself.
What to do this week: vendor security checklist
If you run a business that uses marketing software
| Action | How to check | Why it matters |
|---|---|---|
| List every tool holding customer data | Review connected apps in your store platform, CRM and email system | You cannot assess vendors you have forgotten |
| Cut the fields you share | Compare each sync against what the tool actually uses | Data a vendor never received cannot be exposed there |
| Remove stale integrations | Delete unused connections and rotate API keys on the rest | Old connections keep working after everyone forgets them |
| Read the breach notice clause | Find the notification deadline in each vendor contract, and ask for a firm number of hours at renewal | Sets when you are told, in writing |
| Lock down vendor admin logins | Require MFA or SSO, and remove former staff and agencies | Limits what one stolen password can reach |
| Write the disconnect steps | Document who can revoke each vendor's access and how | Saves hours when it counts |
| Draft the customer notice | Keep a template, and learn the breach reporting rules in each place you sell | You will not want to write it from scratch mid-incident |
If you do not have someone assigned to this, our security hardening work covers it.
If you are a Who Gives A Crap customer
- Be suspicious of unexpected emails, texts, calls and mail claiming to be from the company. Verify before responding, which is also the company's own advice.
- Do not click links in delivery or refund messages you were not expecting. Go to the site directly.
- Expect the company to update you. It says it will do so if it learns anything new that affects you.
Who Gives A Crap data breach questions people are asking
Was Who Gives A Crap hacked?
The company says the unauthorized access happened at a third-party marketing software provider, and that customer accounts were not directly accessed.
Was my credit card exposed?
The company says payment details were not included.
Do I need to change my password?
The company says passwords were not involved. Changing yours does no harm, but scam messages are the more likely risk from this kind of data.
Which software provider was breached?
It has not been named publicly. It is described only as a US-based marketing software provider.
Which countries are affected?
The company says data from its Australian, UK and US stores was involved, and that Canadian customer data was not accessed.
How many customers were affected?
That has not been disclosed.
Has the data been leaked or sold?
That is not known. The company says it has no evidence of misuse so far and does not yet know whether the data was copied or downloaded.
What is a third-party data breach?
It is a breach at an outside company that holds or processes your data, such as a software vendor, rather than in your own systems. Your customers' information can be exposed even if your own systems are never touched.
The bigger lesson
You can hand a customer list to a vendor, but you cannot hand off responsibility for it. Share less, keep track of who holds what, and agree on how fast you will be told before anything goes wrong.
See how we approach security hardening, or get a quote for a review of your vendor access.
Get security alerts by email, with the free checklist, at our security alerts page.
Sources: ABC News; Cyber Daily; CISA.
Have a question about this article?
Ask it here and we will answer you directly by email. Questions are private, never posted.
Security alerts by email
Hear about the next one first.
When attackers start using a flaw in software businesses run on, we email what it is, whether it touches you and what to do that week, with a round-up of our latest security writing. Free, one-click unsubscribe. You get the checklist straight away: 12 things to secure this week.
Want a result like this?
Security alerts, breaches and the technology a business runs on: what happened, who it affects and what to do.
Get a Tech QuoteKeep reading
Aesto Data Breach: What Is Confirmed About the Healthcare Records Vendor, 4,508 South Carolina Residents, and What to Ask Your Vendors This Week
Patient records vendor Aesto says data may have been accessed or taken from its AWS systems in December 2025....
Mirae Asset Securities Data Breach: About 39,000 People Exposed, Mostly Staff, and What Finance Firms Should Check This Week
Mirae Asset Securities says two attacks on November 4 and 5 exposed data on about 39,000 people, including 35,...
NBFC Cyberattack: Two Indian Lenders Report Over Rs 7 Crore Stolen Five Days Apart as CERT-In Warns of Payment API Attacks
Spandana Sphoorty and Keerthana Finserv reported Rs 7 crore-plus in unauthorised transfers five days apart. He...
