Who Gives A Crap customer names, contact details and total spend exposed through a marketing software vendor

Australian toilet paper brand Who Gives A Crap told customers on Nov 7 2026 that an unauthorized party accessed customer data held by one of its US-based marketing software providers, which it has not named. The provider says the access began on Oct 30, was identified on Oct 31 and was secured on Nov 1, and it told Who Gives A Crap on Nov 6. Data from the Australian, UK and US stores was involved: first and last names, email addresses, phone numbers, mailing addresses and the total amount each customer has spent. Payment details, order details and passwords were not included, Who Gives A Crap accounts were not directly accessed, and Canadian customers' data was not accessed. The company says it does not yet know whether the data was copied or downloaded, has seen no misuse so far, has disconnected the provider and changed access credentials, and has not said how many customers are affected.

Why this severity: Names, emails, phone numbers, mailing addresses and spend totals for AU, UK and US customers; no payment details or passwords; customer count not disclosed

Started

Oct 30, 2026

• #Who Gives A Crap
• #Australia
• #E-commerce
• #Third Party Vendor
• Data breach

Notes & caveats

The vendor has not been named and Who Gives A Crap says it is still working with the provider to understand the extent of the incident.