Who Gives A Crap Confirms Customer Data Exposed via Third-Party Breach
A US-based marketing software provider suffered a cyber incident, exposing customer personal information.
1Third-Party Security Incident
Australian toilet paper company Who Gives A Crap confirmed that a US-based marketing software provider suffered a cyber security breach. The incident, which occurred in late October, resulted in unauthorized access to customer information. The company was notified of the security failure on November 1, shortly after the provider secured its systems.
2Timeline of Unauthorized Access
According to the company, the unauthorized access to the marketing software provider’s systems began on October 30. The breach was detected on October 31 and successfully secured by November 1. Chief Executive Simon Griffiths stated that the company was informed of the incident on Friday, November 7, and notified affected customers shortly thereafter.
3Scope of Exposed Data
The compromised information includes first and last names, email addresses, phone numbers, mailing addresses, and the total amount spent with the brand. The company clarified that payment details, order histories, and account passwords were not involved in the breach. Furthermore, individual customer accounts remain secure and were not directly accessed by the attackers.
4Geographic Impact Assessment
The breach affected customers located in Australia, the United Kingdom, and the United States. Notably, the company confirmed that data belonging to Canadian customers was not accessed during the incident. The provider reported that the unauthorized party targeted systems holding information specifically from the company's online shopfronts serving these three primary international markets.
5Immediate Remediation Actions
Upon learning of the breach, Who Gives A Crap disconnected the affected third-party provider from its internal systems. The company also updated its access credentials to prevent further unauthorized entry. They are currently communicating with the provider to investigate the full extent of the incident and determine if additional security measures are required.
6Phishing and Scam Risks
While there is currently no evidence that the stolen information has been misused, the company warned customers to remain vigilant. Scammers may use the exposed personal details to make fraudulent emails, text messages, or phone calls appear legitimate. Customers are encouraged to verify any communication claiming to be from the toilet paper brand.
7Regulatory and Support Engagement
The company stated it will engage with relevant regulatory authorities as required by law. For customers concerned about potential identity theft or fraudulent activity, the brand has directed them to contact IDCARE and report any suspicious interactions to Scamwatch. The company continues to monitor the situation closely to protect its customer base.
8Uncertainty Regarding Data Exfiltration
Despite the investigation, the company does not yet know whether the accessed customer information was actually copied or downloaded by the unauthorized party. Chief Executive Simon Griffiths apologized for the incident, emphasizing that the team is working to strengthen defenses. They have promised to provide updates if new information regarding the breach emerges.