The Who Gives A Crap data breach is a vendor incident in which customer names, email addresses, phone numbers, postal addresses and total spending may have been viewed. The Australian toilet-paper company told customers on 7 November 2026 that an unauthorised party accessed the data through a third-party marketing software provider based in the United States. The access began on 30 October, was detected on 31 October and was secured on 1 November. Customers in Australia, the United Kingdom and the United States may have been affected, and no victim count has been published.
The disclosure was made by customer notice on Saturday 7 November 2026, and ua.news, citing ABC News Australia, reported it the same day. Who Gives A Crap sells toilet paper by subscription in several markets. The incident involved a marketing software provider holding a copy of the customer list, not the company's own storefront.
Access through the marketing provider
The unauthorised access ran through a marketing software provider used by Who Gives A Crap. The provider is based in the United States. The company has not named it. According to the company statement carried by ABC News, the access began on 30 October 2026, was detected on 31 October and was secured on 1 November. The company was informed of the incident on Friday 6 November and notified customers the following day.
Chief executive Simon Griffiths fronted the disclosure. He said: "Certain personal information of our customers was accessed without permission during a security incident involving one of our marketing software vendors." No attacker group has been named, and no attack method has been described in the reporting reviewed.
The company said it disconnected the provider from its systems and changed access credentials. It said it continues to communicate with the provider about the investigation and would engage with relevant regulators if necessary. No regulator has been named in the reporting, and no regulator has commented publicly on the incident as of 8 November 2026.
The data involved
The company lists five categories of data that may have been viewed: first and last names, email addresses, phone numbers, postal addresses and total spending with Who Gives A Crap. The wording is "may have been viewed". The company has not said that every customer was affected, and it has not published a number of affected customers.
Three categories were not exposed, according to the company: payment information, order details and passwords. Customer accounts were not directly compromised, and the company said accounts remain secure.
The total-spending figure stands out. A spending total, added to a name, an email address, a phone number and a postal address, lets a sender tailor a message to the recipient: a refund lure for a heavy buyer, or a loyalty reward for a long-standing subscriber. The figure alone opens no account.
The company also said it does not yet know whether the data was copied or downloaded. Access and copying are different outcomes, and the company has not stated which one occurred. The company said there was "no evidence of misuse at this point", which describes what it has seen so far and is not a guarantee about what happens next.
The countries affected
Customers in Australia, the United Kingdom and the United States may have been affected. The company said no personal data from Canadian customers was affected. It has not explained why Canada was excluded, and the reporting does not say whether the vendor held a separate data set for Canadian customers or whether the Canadian customer base sat on a different system.
The vendor pattern
The entry point was a marketing software provider holding a copy of the customer list. Email and SMS platforms, customer-data platforms and loyalty tools hold the same material: a current list of real customers with contact details attached. Those platforms sit outside the retailer's direct control, so a shop can harden its own storefront and still lose its customer list through a vendor.
The unnamed vendor is the largest gap in the story. Other brands using the same marketing platform may be affected, and they cannot check without knowing which provider is involved. Nothing in the reporting links any other company to the affected provider, and this article does not speculate about which provider it is. Which website leaked my email explains how a unique alias for each service traces a leak back to the service that leaked it. The company has not said whether the detection came from the vendor's own alerting or from its own monitoring.
Actions for affected customers
The company advised customers to be alert to unexpected emails, messages, calls and postal mailings, and to verify communications that claim to be sent on its behalf. The exposed data is the material used to make a scam message convincing: a real name, a real email address, a real phone number and a real postal address.
The company advised customers to treat a message that mentions Who Gives A Crap, a refund or a loyalty reward with suspicion, and not to click links in unsolicited messages. It said to verify any message through the company's own website, reached by typing the address directly. One-time codes and card details should never be shared with anyone who makes first contact.
Passwords were not exposed, according to the company, so a password change is not the first priority on the strength of this notice alone. Anyone who reuses one password across sites still faces the wider risk, because the exposed email address is now a known-good address that can be tried against other services. Checking whether the same address appears in other breaches is worth doing, and what to do when your email is in a data breach sets out the steps in order. The company's advice points to phishing as the risk to watch here. How phishing uses your leaked email explains the mechanics of the messages to expect.
Your address is probably in this file. Check whether it is, do the password work above, and then fix the part you control: the address you hand out next time. One AliasFleet alias per service means the next leak can only point back to the service that leaked it. Founders Club is $7 a month, locked forever, instead of $12. Early members only.
The investigation
The investigation continues, and the company is still communicating with the provider. Four facts remain unknown as of 8 November 2026: the name of the vendor, the number of affected customers, whether the data was copied or downloaded, and whether any regulator has been engaged.
The company has not published a public notice page. The disclosure was made by customer email and carried by ABC News Australia, and the company's own site showed no notice on its homepage when checked on 8 November 2026. A public notice page may appear as the investigation develops, and the facts above should be re-checked against it when it does.
Top comments (0)