Who Gives A Crap, the Australian toilet paper company, has notified customers that an unauthorized party accessed their personal data through an external marketing software provider. Customers in Australia, the United Kingdom and the United States are affected, according to the company’s notification as reported by ABC News.
What Data the Unauthorized Party Accessed
The exposed data includes names, phone numbers, mailing addresses, email addresses and per-customer spend. Canadian customers are reportedly not affected. The company has not confirmed how many customers are involved, and the marketing provider has not been named.
How the Breach Unfolded Across One Week
The breach occurred on October 30, and the provider detected it on October 31. The provider informed Who Gives A Crap on November 6, and the company notified customers the same day. The gap of about a week between detection and notification to the company is the main timing detail in the account.
Response From the Provider and the Company
The provider has been disconnected and its credentials updated. There is no evidence of misuse so far, according to the company’s statement. Customers were warned about phishing.
Why Customer Details Create Phishing Exposure
The combination of real names, contact details and purchase spend can make fraudulent messages more convincing, because the sender can reference accurate personal information. The company’s warning reflects that risk. No misuse has been reported, but the data in question is the kind used to personalize scams.
Third-Party Provider Risk in Consumer Retail
The incident sits within a familiar pattern in which customer data held by a vendor is exposed even though the retailer’s own systems are not reported as compromised. Marketing platforms typically receive customer records so they can run campaigns, which places copies of names, addresses and spend history outside the retailer’s direct control. A breach at the provider therefore exposes the retailer’s customers while leaving the retailer dependent on the provider’s detection and notification timing.
That dependence is visible in the timeline here. The provider found the problem a day after it began, yet customers were told a week after that. The sources do not explain the delay between the provider’s detection and the company being informed, and they do not say whether the provider gave a reason.
Questions the Public Account Leaves Open
Several details remain unreported: the identity of the marketing provider, whether other clients of the provider were affected, the method the unauthorized party used and the number of Who Gives A Crap customers whose data was taken. The reports also do not say whether regulators in the three affected countries have been notified.
Who Gives A Crap’s account describes the scope as limited to contact and spend data, with no mention of payment card details or passwords. The company has said the provider was disconnected and that it is not aware of misuse, which remains the status until further notice.
Customer Notification Timeline and Regional Scope
The notification covers customers in three markets: Australia, the United Kingdom and the United States. The reports say Canadian customers were not affected, though the basis for that is not given, and the number of people involved remains unconfirmed.
The provider’s detection on October 31, a day after the breach, shows the intrusion was caught quickly. The company learning of it on November 6 means about six days passed in between, during which the sources do not say what the provider was doing or whether customers’ data was further exposed.
Who Gives A Crap’s response consisted of disconnecting the provider, updating credentials and warning customers about phishing. The company said it has seen no evidence of misuse so far.
The incident was reported through ABC News, with the provider unnamed. Until the provider is identified, it is not possible to say whether other retailers using the same software were affected.
