Who Gives A Crap Data Breach: Customer Names and Addresses Exposed Through a Marketing Vendor

Who Gives A Crap, the Australian toilet paper company, has told customers that their names and contact details were exposed in a breach at a US-based marketing software provider it uses. Customers of its Australian, UK and US stores are affected.

What was taken, and what wasn't

The ABC reported that the exposed records hold first and last names, email addresses, phone numbers, mailing addresses and the total amount each customer had spent with the brand. Chief executive Simon Griffiths said "payment details, order details and passwords were not involved", and that customers' own accounts with the company weren't directly accessed.

The company doesn't yet know "whether the information was copied or downloaded". It reports no evidence of misuse so far. Canada's store wasn't affected: the provider found no personal information from Canadian customers was accessed.

Eight days from intrusion to customer email

The unauthorised access began on 30 October, was spotted on 31 October and was shut off on 1 November. The vendor told Who Gives A Crap on Friday 6 November, and affected customers got emails on Saturday 7 November.

The provider still has no name.

Who Gives A Crap says it has disconnected the provider from its systems completely and changed access credentials. Tech Insider points out that no count of affected customers has been published, and no group has publicly claimed the intrusion. The company says it "will engage with the relevant regulatory authorities as required".

What customers are told to do

The company asks customers to watch for unexpected emails, text messages, calls and mail, and to check any message that claims to come from Who Gives A Crap before acting on it. It says it will update customers if it learns anything new that affects them.