Who Gives A Crap Reports Customer Data Breach
A third-party marketing software provider's security incident exposed contact and purchase-total details for customers in Australia, the UK and the US.
Updated on Nov. 7, 2026 in Cybersecurity
Live Poll
Do you trust companies to keep your personal information secure?
Who Gives A Crap disclosed that customer personal information was accessed without authorisation in a security incident at a marketing software provider. Systems holding information from its Australian, UK and US stores were breached, while Canadian customers' data was not accessed.
Why it matters
Exposed names, email addresses, phone numbers and mailing addresses can be used for targeted phishing or scam attempts against affected customers. The incident highlights the security risks retailers face when sharing customer data with outside software vendors.
The disclosure is a company notice to customers rather than a regulatory filing, and it covers three of four markets served. The investigation into the provider's handling of the incident is still ongoing.
The players
Who Gives A Crap
An Australian toilet paper and household products company that sells to customers in Australia, the United Kingdom, the United States and Canada.
The details
Accessed information included first and last names, email addresses, phone numbers, mailing addresses and total amount spent. Payment details, order details and passwords were not involved, and customers' Who Gives A Crap accounts were not directly accessed.
Timeline
30 October 2026: Unauthorised access to customer data began.
31 October 2026: The breach was identified.
1 November 2026: Access was secured.
6 November 2026: The company was informed of the breach.
7 November 2026: Customer emails about the breach were sent.
Vendor Risk
Like the 2013 Target breach, which was traced to credentials held by an outside HVAC contractor, this incident shows how retailers' customer data can be exposed through vendors they do not directly control. Who Gives A Crap's direct systems were not the point of entry in the way Target's were, but the exposure path runs through a third-party marketing tool in the same way.
Customers whose names, emails, phone numbers or addresses were exposed may see targeted phishing messages, so they should treat unexpected emails or calls about orders with caution. Since payment details and passwords were not involved, no account or card changes are reported as necessary.
The takeaway
Customers should watch for unsolicited messages referencing their Who Gives A Crap orders and avoid clicking links in unexpected emails. Retailers and shoppers alike benefit from treating vendor access to customer data as a standing security risk.
Further reading
For more on how companies protect customer information, see the Cybersecurity section.
Live Poll
Do you trust companies to keep your personal information secure?
