Who Gives A Crap

Summary

The Australian toilet-paper brand disclosed that an unauthorised party accessed customer personal information through a third-party marketing-software provider. Access began, was detected, and was secured within a short window before customers were notified several days later. The exposed data included names, email addresses, phone numbers, postal addresses, and total spending, while payment information, order details, and passwords were not exposed and customer accounts were not directly compromised. Customers in Australia, the United Kingdom, and the United States were affected, but Canadian customer data was not touched. The company severed its connection with the provider and changed access credentials, though it has not named the vendor, published an affected customer count, or confirmed whether the information was copied or downloaded.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Who Gives A Crap, the Australian toilet-paper brand, notified customers on Saturday, November 7, 2026, that an unauthorised party had accessed some of their personal information through a third-party marketing-software provider. The incident affected customers in Australia, the United Kingdom, and the United States, while the company stated that no personal data from Canadian customers was touched. Unauthorised access began on October 30, was detected on October 31, and was secured by November 1, meaning the access lasted about two days from beginning to containment. The categories of data that may have been viewed include first and last names, email addresses, phone numbers, postal addresses, and total spending with Who Gives A Crap. The company said payment information, order details, and passwords were not exposed, and that customer accounts were not directly compromised and remained secure. The notice used the wording "may have been," and the company has not published a total number of affected customers. The marketing software provider was not named in the company's public materials. The company also stated it does not know whether the accessed information was duplicated or downloaded, and it did not explain why Canadian customers were excluded from the incident.

Chief Executive Simon Griffiths delivered the disclosure, stating that certain personal information of customers was accessed without permission during a security incident involving one of the company's marketing software vendors. In response, Who Gives A Crap cut its connections with the affected provider and changed access credentials. The company reported there was no evidence of misuse at the time of notification. Customers learned of the incident on November 7, six days after containment and seven days after detection. The notification created obligations across three jurisdictions, with Australian customers covered by the Privacy Act and its notifiable data breaches scheme. Regulators in each of the three affected markets tend to scrutinise the window between detection and public notice, though none had commented in the reporting reviewed. As a private company, Who Gives A Crap has no share price to track, but potential impacts include changes in unsubscribes, support-desk volume, and whether repeat buyers hesitate at checkout. The company has not published figures for remediation, legal work, or customer outreach. A multi-country notification is more expensive to run than a single-market one because each jurisdiction has its own wording, timing, and regulator expectations. No other brands have been named in connection with this incident, and nothing in the reporting links any other company to the affected provider.

Sources

Sources available to members: 1 source.