Who Gives A Crap Told Customers About a Breach Through a Marketing Vendor, Not Its Own Systems

A toilet paper company just taught a security lesson

Who Gives A Crap, the Australian toilet paper brand, told customers on Saturday, November 7, that an unauthorized party reached some of their personal information through a third-party marketing software provider. Customers in Australia, the United Kingdom, and the United States were affected. Canadian customers were not.

The company says the access began on October 30, was detected on October 31, and was secured by November 1. The exposed data includes names, email addresses, phone numbers, postal addresses, and total spending. Payment information, order details, and passwords were not exposed, and customer accounts were not directly compromised. Chief executive Simon Griffiths fronted the disclosure, and the company says there is no evidence of misuse so far.

It is a small breach by 2026 standards. The company has not published a headcount of affected customers. Compare that with the SMBC Consumer Finance breach this same week, which exposed up to 320,118 people including driver's license numbers, or the Arara breach with 77 million email addresses. Who Gives A Crap looks minor next to those. That is exactly why it is worth paying attention to.

The breach happened at a vendor, not at Who Gives A Crap

The company's own systems were not the entry point. The unauthorized access came through a marketing software provider, which is the same pattern behind a long list of recent incidents. Your data does not only live with the companies you buy from. It lives with their email platforms, their analytics tools, their customer support software, and every other vendor they plug in.

This is the part most breach notices bury. Who Gives A Crap deserves credit for stating it plainly: the access came through a third-party marketing provider. Many companies describe the same situation as an "incident involving a service provider" and hope nobody asks follow-up questions. The honest version is simpler. A company you never chose, whose name you never saw, had your name, email, phone number, and home address, and someone got into their system.

The timeline also deserves a note. Access began October 30 and was detected October 31. That is fast detection by industry standards, where attackers often roam for weeks or months. The company then took a week to notify customers, which is the normal gap while a company confirms what was taken and who was affected. The notification went out on a Saturday, which is unusual and suggests the company did not want to sit on it over the weekend.

What affected customers should actually do

The exposed data is the starter kit for phishing. A scammer who knows your name, email, phone number, and home address can write a convincing message pretending to be Who Gives A Crap, your bank, or a delivery company. The total spending figure adds a nasty detail: a fake "your subscription has changed" email can quote a plausible amount.

Three steps cover the real risk. First, expect phishing emails and texts that reference Who Gives A Crap or your order history, and do not click links in them. Go to the company's site directly if you need to check anything. Second, if you reused the email address and any password combination anywhere else, change those passwords, because the company says passwords were not exposed but credential reuse makes every breach worse. Third, read our guide on how to spot a phishing email before the messages start arriving, not after you have already clicked one.

There is no need to cancel cards or freeze credit over this incident. The company says no payment data was exposed, and nothing in the disclosure contradicts that. The risk here is social engineering, not financial theft.

The pattern that keeps repeating

This is the third notable breach disclosure in a week that traces back to a shared platform or vendor rather than the victim company's own network. The SMBC incident exposed customers of 189 partner banks through one centralized credit platform. The Amadeus incident exposed airline booking records across multiple carriers through one reservation system. Who Gives A Crap is the consumer version of the same story.

Consolidation creates efficiency, and efficiency creates single points of failure. One marketing platform serves thousands of brands. One reservation system serves hundreds of airlines. One credit platform serves 189 banks. Breach one, and the blast radius is every customer of every client.

Regulators have noticed, and the questions after each incident are getting sharper. But for customers, the practical lesson does not change. Assume your data is held by vendors you never met. Use a unique password everywhere, turn on two-factor authentication, and treat every unexpected email as suspicious until proven otherwise. The next breach notice will probably come from another company you trust, about another vendor you never heard of.