# Who Gives A Crap customer names, contact details and total spend exposed through a marketing software vendor · pwn.watch > Australian toilet paper brand Who Gives A Crap told customers on Nov 7 2026 that an unauthorized party accessed customer data held by one of its US-based marketing software providers, which it has not named. The provider says the access began on Oct 30, was identified on Oct 31 and was secured on Nov 1, and it told Who Gives A Crap on Nov 6. Data from the Australian, UK and US stores was involved: first and last names, email addresses, phone numbers, mailing addresses and the total amount each customer has spent. Payment details, order details and passwords were not included, Who Gives A Crap accounts were not directly accessed, and Canadian customers' data was not accessed. The company says it does not yet know whether the data was copied or downloaded, has seen no misuse so far, has disconnected the provider and changed access credentials, and has not said how many customers are affected. Page: https://pwn.watch/i/who-gives-a-crap-marketing-vendor-customer-data-breach-nov-2026 · generated 2026-11-08T20:22:39.494Z ## Status - Severity: medium · status: live · patch: partial - Product: Who Gives A Crap customer data (third-party marketing software provider) - Started: 2026-10-30 ## Follow this incident - RSS (one item per update): https://pwn.watch/i/who-gives-a-crap-marketing-vendor-customer-data-breach-nov-2026/feed.xml - JSON Feed: https://pwn.watch/i/who-gives-a-crap-marketing-vendor-customer-data-breach-nov-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/who-gives-a-crap-marketing-vendor-customer-data-breach-nov-2026.json - This file: https://pwn.watch/i/who-gives-a-crap-marketing-vendor-customer-data-breach-nov-2026/llms.txt ## Updates (newest first) - 2026-11-07: Who Gives A Crap emails affected customers in Australia, the UK and the US: names, email addresses, phone numbers, mailing addresses and total spend were accessed; payment details, order details and passwords were not. It disconnects the provider and changes access credentials. Canadian customers' data was not accessed. (https://www.abc.net.au/news/2026-11-08/who-gives-a-crap-hack/107359858) - 2026-11-06: The marketing software provider informs Who Gives A Crap of the incident. (https://www.cyberdaily.au/security/14416-aussie-recycled-toilet-paper-brand-who-gives-a-crap-discloses-data-breach) - 2026-10-30: An unauthorized party starts accessing Who Gives A Crap customer data held by one of its US-based marketing software providers. The provider identifies the access on Oct 31 and secures it on Nov 1. (https://www.abc.net.au/news/2026-11-08/who-gives-a-crap-hack/107359858) ## Fix brief # Security brief: Who Gives A Crap customer names, contact details and total spend exposed through a marketing software vendor Source: https://pwn.watch/i/who-gives-a-crap-marketing-vendor-customer-data-breach-nov-2026 · status: live · severity: medium · updated Nov 8, 2026, 19:12 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is Australian toilet paper brand Who Gives A Crap told customers on Nov 7 2026 that an unauthorized party accessed customer data held by one of its US-based marketing software providers, which it has not named. The provider says the access began on Oct 30, was identified on Oct 31 and was secured on Nov 1, and it told Who Gives A Crap on Nov 6. Data from the Australian, UK and US stores was involved: first and last names, email addresses, phone numbers, mailing addresses and the total amount each customer has spent. Payment details, order details and passwords were not included, Who Gives A Crap accounts were not directly accessed, and Canadian customers' data was not accessed. The company says it does not yet know whether the data was copied or downloaded, has seen no misuse so far, has disconnected the provider and changed access credentials, and has not said how many customers are affected. Severity detail: Names, emails, phone numbers, mailing addresses and spend totals for AU, UK and US customers; no payment details or passwords; customer count not disclosed - Product: Who Gives A Crap customer data (third-party marketing software provider) ## Affected versions - Not specified in the data. Check the advisories below. ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix No fixed version is listed. Follow the vendor advisory below. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes There is nothing to patch. If you have bought from Who Gives A Crap in Australia, the UK or the US, expect phishing emails, texts, calls and letters that use your real name, address and purchase history to look convincing, and verify anything claiming to be from the company through its official site. ## Latest updates - Nov 7, 2026: Who Gives A Crap emails affected customers in Australia, the UK and the US: names, email addresses, phone numbers, mailing addresses and total spend were accessed; payment details, order details and passwords were not. It disconnects the provider and changes access credentials. Canadian customers' data was not accessed. - Nov 6, 2026: The marketing software provider informs Who Gives A Crap of the incident. - Oct 30, 2026: An unauthorized party starts accessing Who Gives A Crap customer data held by one of its US-based marketing software providers. The provider identifies the access on Oct 31 and secures it on Nov 1. ## Write-ups & news - [Who Gives A Crap confirms customer data exposed in software breach](https://www.abc.net.au/news/2026-11-08/who-gives-a-crap-hack/107359858) - [Aussie recycled toilet paper brand Who Gives a Crap discloses data breach](https://www.cyberdaily.au/security/14416-aussie-recycled-toilet-paper-brand-who-gives-a-crap-discloses-data-breach) - [Who Gives A Crap customers caught up in data breach after third-party provider hacked](https://7news.com.au/news/who-gives-a-crap-customers-caught-up-in-data-breach-after-third-party-provider-hacked-c-23131497) ## Caveats The vendor has not been named and Who Gives A Crap says it is still working with the provider to understand the extent of the incident. --- Machine-readable: https://pwn.watch/i/who-gives-a-crap-marketing-vendor-customer-data-breach-nov-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.