Who Gives A Crap customer data breach via third-party software provider

Consensus Summary

Australian toilet paper company Who Gives A Crap confirmed on November 7, 2026, that a cybersecurity breach at a US-based third-party marketing software provider exposed customer data from its Australian, UK, and US stores. The unauthorized access began on October 30, was detected the following day, and secured by November 1, though the company remains uncertain whether any data was copied or downloaded. Affected customer details included names, contact information, and total spending amounts, while payment data and passwords were spared. The breach was disclosed to customers via email, with Who Gives A Crap emphasizing that accounts remained secure but urging vigilance against scams using stolen personal information.

The incident stems from a security failure at an unnamed US marketing software provider handling customer data for Who Gives A Crap’s online shopfront. Both outlets agree the breach was limited to specific customer details—excluding sensitive payment or order information—and that the company acted swiftly to disconnect the provider and update access credentials. The company’s CEO, Simon Griffiths, issued a public apology, acknowledging the breach while reassuring customers that no evidence of misuse had yet emerged. This follows a broader trend of third-party vendor breaches exposing consumer data, highlighting the risks of outsourcing digital infrastructure.

Simon Griffiths addressed customers directly in statements carried by both 7NEWS and ABC, stressing the company’s commitment to transparency and security. He noted that while the breach was unwelcome, the company was prioritizing communication and regulatory engagement. Griffiths also advised customers to report suspicious activity to organizations like IDCARE and Scamwatch, reflecting the heightened risk of phishing attacks using stolen personal details. The company’s proactive disconnection of the provider and credential changes were framed as immediate steps to mitigate further harm, though uncertainties about data exfiltration persisted.

While both sources align on key facts—such as the breach timeline, affected customer data, and the company’s response—minor discrepancies exist in reporting the notification date. 7NEWS states customers were emailed on Friday, November 7, whereas ABC clarifies the notification occurred on Saturday, November 7, with the company informed 24 hours earlier on Friday, November 6. These differences, though minor, underscore the importance of precise timing in breach disclosures. Neither outlet specifies the identity of the third-party provider, and both emphasize the company’s ongoing investigation and regulatory cooperation.

As of November 7, 2026, Who Gives A Crap has not confirmed whether customer data was actually copied or misused, though it has ruled out direct account access. The company pledged to update customers if new information emerges, signaling a commitment to transparency amid the fallout. The breach serves as a cautionary tale for businesses relying on third-party vendors, particularly in handling sensitive customer data. With scammers likely to exploit the stolen details, the company’s warnings about phishing attempts remain critical for affected consumers moving forward.