Who Gives A Crap confirms customer personal data exposed via breach at unnamed US marketing software provider
Who Gives A Crap, the Australian toilet paper seller, has told customers in Australia, the United Kingdom and the United States that their personal information was accessed without authorisation in a security incident at an unnamed US-based marketing software provider. The exposed fields are first and last names, email addresses, phone numbers, mailing addresses and total spending with the company, while payment details, order details and passwords were not involved and customer accounts were not directly accessed. The company does not yet know whether the data was copied or downloaded, and it reports no evidence of misuse so far. The provider has not been named, the number of affected customers has not been disclosed, and the UK ICO says it is assessing an incident report. The main risk for customers is scam or phishing that uses their real details, and the story carries no vulnerability, CVE or attribution, so the urgency is medium.
Detalhes técnicos
- The intruder reached the provider's systems on 30 October 2026, the provider detected the intrusion on 31 October and says it had secured its systems by 1 November (article).
- Who Gives A Crap was not told until 6 November, and the article notes the provider's reason for the five-day delay is unclear (article; abc.net.au).
- Customers were emailed on Saturday 7 November (abc.net.au; digitalcitizen.life).
- Canadian customers' personal information was not accessed, according to the supplier (article).
- Neither the article nor the search results name a software flaw, malware family or threat actor, so this is a third-party data exposure rather than a documented vulnerability exploitation.
Remediação
- The company disconnected the provider from its systems, changed access credentials and stopped sending it customer information (digitalcitizen.life; article).
- The company says it never asks for payment details by email or text and does not contact customers by phone (digitalcitizen.life), so unsolicited messages using real customer details should be treated as suspect (article).
- The company says it is reviewing its vendor security arrangements (vespernews.com).
- No vendor fix or patch applies, as the incident is a third-party data exposure, and the provider has not been publicly identified (article).
Linha do tempo
-
Who Gives A Crap confirms customer personal data exposed via breach at unnamed US marketing software provider
ler a análise desta fonte ocultar
Who Gives A Crap, the Australian toilet paper seller, has told customers in Australia, the United Kingdom and the United States that their personal information was accessed without authorisation in a security incident at an unnamed US-based marketing software provider. The exposed fields are first and last names, email addresses, phone numbers, mailing addresses and total spending with the company, while payment details, order details and passwords were not involved and customer accounts were not directly accessed. The company does not yet know whether the data was copied or downloaded, and it reports no evidence of misuse so far. The provider has not been named, the number of affected customers has not been disclosed, and the UK ICO says it is assessing an incident report. The main risk for customers is scam or phishing that uses their real details, and the story carries no vulnerability, CVE or attribution, so the urgency is medium.
Technical Details
- The intruder reached the provider's systems on 30 October 2026, the provider detected the intrusion on 31 October and says it had secured its systems by 1 November (article).
- Who Gives A Crap was not told until 6 November, and the article notes the provider's reason for the five-day delay is unclear (article; abc.net.au).
- Customers were emailed on Saturday 7 November (abc.net.au; digitalcitizen.life).
- Canadian customers' personal information was not accessed, according to the supplier (article).
- Neither the article nor the search results name a software flaw, malware family or threat actor, so this is a third-party data exposure rather than a documented vulnerability exploitation.
Remediation
- The company disconnected the provider from its systems, changed access credentials and stopped sending it customer information (digitalcitizen.life; article).
- The company says it never asks for payment details by email or text and does not contact customers by phone (digitalcitizen.life), so unsolicited messages using real customer details should be treated as suspect (article).
- The company says it is reviewing its vendor security arrangements (vespernews.com).
- No vendor fix or patch applies, as the incident is a third-party data exposure, and the provider has not been publicly identified (article).