Customers of toilet paper company Who Gives A Crap in Australia, the UK and the US have had their names, contact details and spending totals accessed in a security incident at a US-based marketing software provider, the company has told them.
The company said customers’ personal information may have been accessed in a third-party cyber security incident at the provider. ABC News reported that the statement was released on Saturday 7 November. In it, chief executive Simon Griffiths said: “Some of our customers’ personal information was accessed without authorisation in a security incident at one of our marketing software providers”.
“We know this is unwelcome news, so we’ll be as clear as we can about what we know and what we don’t yet know,” Griffiths said.
Has a company told you your personal data was caught up in a breach this year?
Choose an answer, then select Vote.
What Was and Was Not Exposed
The details involved are first and last names, email addresses, phone numbers, mailing addresses and the total amount spent with the company, according to ABC News and 7NEWS.
Some details were left out of it. ABC News reported that payment details, order details and passwords were not involved, and that customer accounts were not directly accessed.
“Your account with Who Gives A Crap is secure and was not directly accessed,” Griffiths told customers in emails, 7NEWS reported.
The affected stores are those in Australia, the UK and the US. The provider reported that no personal information from Canadian customers was accessed, according to ABC News.
The number of affected customers has not been disclosed, SmartCompany reported.
How the Incident Unfolded
The access at the provider began on 30 October, was identified on 31 October and was secured on 1 November, according to ABC News and 7NEWS, which cited the company’s notice.
Griffiths said the company was informed on Friday 6 November, ABC News reported. SmartCompany said the company was reportedly notified on 6 November, six days after the provider detected the incident.
The company does not yet know whether the information was copied or downloaded, and says it has “no evidence of misuse so far”, ABC News reported.
The Company’s Response
The provider has been cut off. The company disconnected it from its systems completely and changed access credentials, according to ABC News, and says it will engage with the relevant regulatory authorities as required.
“We’re communicating with the third-party provider to understand the details of their investigation to determine if there is any further action required,” the company said, as reported by 7NEWS.
The Phishing Risk
Griffiths also told customers what the company sees as the main risk, 7NEWS reported.
“The main concern is scam or phishing messages that use your real details to look convincing.”
Troy Hunt, who runs Have I Been Pwned, made a similar point to SmartCompany. He said the data could be used for targeted phishing. He also questioned why a marketing firm held customers’ addresses, phone numbers and spending, and said limiting what is shared with suppliers is the most practical protection.
“If you do have a data breach, how do you minimise its impact? Well, less data.”
What Customers Can Do
Customers were urged to verify any contact that claims to be from the company, ABC News reported. According to 7NEWS, they were directed to IDCARE for identity concerns and to Scamwatch to report fraud.
A message that carries a customer’s real name, address and spending total can look genuine, which is the risk both Griffiths and Hunt described.
The company has not said how many customers are affected, and it is still seeking the details of the provider’s investigation.
Our Technology archive has more security coverage, including the Node.js security releases that fixed 10 flaws.
Sources: ABC News, “Who Gives A Crap confirms customer data exposed in software breach”, 8 November 2026 (https://www.abc.net.au/news/2026-11-08/who-gives-a-crap-hack/107359858); 7NEWS, “Who Gives A Crap customers caught up in data breach after third-party provider hacked”, 8 November 2026 (https://7news.com.au/news/who-gives-a-crap-customers-caught-up-in-data-breach-after-third-party-provider-hacked-c-23131497); SmartCompany, “Who Gives A Crap data breach raises questions over third-party security risks”, 9 November 2026 (https://www.smartcompany.com.au/information-technology/who-gives-a-crap-data-breach-raises-questions-over-third-party-security-risks/)
Photo: interestedbystandr, CC BY 2.0, via Wikimedia Commons.
A stand-in picture: three plain rolls of toilet paper on a timber bench. They are not Who Gives A Crap products, and the photograph has no connection to the incident.
