# Who Gives A Crap Confirms Customer Data Breach via Third-Party Software Direct-to-consumer brand reports unauthorized access to customer contact details through marketing software provider. - **Source:** [ABC Australia – Just In](https://www.abc.net.au/news/justin) - **Published:** 2026-11-07 - **Topic:** [technology](https://brifing.si/c/technology) - **Original article:** - **On Brifing:** https://brifing.si/s/50a2e13e-d5af-4f5d-8f41-f1400c287f2c ## Third-Party Data Exposure Toilet paper company Who Gives A Crap confirmed a security breach involving a US-based marketing software provider. The incident resulted in unauthorized access to customer information stored within the third-party system. The company was notified of the breach on Friday, just 24 hours before issuing a public statement to its affected customer base. ## Timeline of Incident The unauthorized access to the marketing platform began on October 30. The breach was identified by the provider on October 31, and the vulnerability was successfully secured by November 1. Following the discovery, Who Gives A Crap immediately disconnected the software provider from its internal systems and updated all relevant access credentials. ## Scope of Compromised Data Exposed information includes customer first and last names, email addresses, phone numbers, mailing addresses, and total spending history. The company confirmed that payment details, order specifics, and account passwords were not compromised during the incident. Furthermore, the brand stated that its own internal customer accounts remain secure and were not directly accessed. ## Geographic Impact Assessment The breach affected customers located in Australia, the United Kingdom, and the United States. Notably, the company reported that data belonging to Canadian customers was not accessed during the security incident. The firm is currently working with the unnamed software provider to investigate the full extent of the unauthorized data access and potential exposure. ## Executive Response Strategy Chief Executive Simon Griffiths issued a statement apologizing for the incident and emphasizing transparency. He noted that while the company has no evidence of data misuse so far, they remain uncertain if the information was copied or downloaded. The firm is actively monitoring the situation and coordinating with relevant regulatory authorities as required. ## Customer Safety Measures Who Gives A Crap has urged customers to remain vigilant against unexpected communications, including emails, text messages, or phone calls. They advised users to verify any claims purportedly coming from the brand. The company promised to provide further updates to customers if new information regarding the security incident or their data becomes available. ## Supply Chain Security Risks This incident highlights the growing vulnerability of companies to third-party software breaches. Even when a brand maintains secure internal systems, reliance on external marketing or data processing tools creates a wider attack surface. Organizations are increasingly forced to vet the security protocols of their vendors to prevent downstream impacts on consumer privacy. ## Regulatory and Future Outlook The company is currently evaluating whether further actions are necessary based on their ongoing investigation with the provider. Future efforts will focus on strengthening defenses against similar breaches and ensuring vendor compliance. This event serves as a reminder for direct-to-consumer brands to prioritize data governance across all integrated third-party software platforms. ## Sources covering this story - https://www.abc.net.au/news/2026-11-08/who-gives-a-crap-hack/107359858 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._