Who Gives A Crap customer data exposed via breached third-party marketing software provider
Severity: medium · Patch status: no-fix-needed · Since 2026-11-09
Toilet paper retailer Who Gives A Crap disclosed that an intruder accessed customer personal information through a third-party US-based marketing software provider. The supplier's systems were breached on 2026-10-30, secured by 2026-11-01, but Who Gives A Crap was only notified on 2026-11-06. Exposed data includes names, email addresses, phone numbers, mailing addresses, and total customer spend; payment details, order details, and passwords were not involved, and customer accounts were not directly accessed. The company does not yet know whether data was copied or downloaded and has found no evidence of misuse. Customers in Australia, the UK, and US are affected; Canadian customers were not. The provider has been disconnected, credentials rotated, and the ICO is assessing the report. Main risk is convincing phishing using real customer details.
What to do
- Warn customers to be alert to phishing emails, texts, and calls using their real details
- Review and tighten third-party/vendor access and require prompt breach notification in contracts
- Rotate credentials and audit integrations with marketing software providers
- Monitor for misuse of exposed customer data and assess regulatory notification obligations (ICO/GDPR, etc.)
Sources
All live incidents on Threat Watch
