Who Gives A Crap breach: customer names, contact details and spending totals may have been accessed through a marketing-software provider
Who Gives A Crap told customers on November 7, 2026 that some customers' personal information was accessed without authorisation in a security incident at one of its marketing-software providers, and that first and last names, email addresses, phone numbers, postal addresses and total spending may have been viewed; the company has not said how many customers were affected.
What happened
Who Gives A Crap, the Australian toilet-paper brand, told customers on Saturday, November 7, 2026 that some of their personal information had been accessed without authorisation in a security incident at one of its marketing-software providers. Chief Executive Simon Griffiths said: “Certain personal information of our customers was accessed without permission during a security incident involving one of our marketing software vendors.” On the company’s account, the unauthorised access began on October 30, was detected on October 31 and was secured by November 1; the company says it was made aware of the breach on Friday, November 6, and emailed affected customers the next day. It has disconnected the affected provider from its systems completely and changed all access credentials. Whether the accessed information was copied or downloaded remains unclear, and the company says there is no evidence of misuse at this point. The provider has not been named. The brand’s own systems were not the entry point, and it says customer accounts were not directly compromised.
Who is affected
Customers in Australia, the United Kingdom and the United States whose personal information was held by the marketing-software provider. The company says no personal data from Canadian customers was accessed. It has not published how many customers received the notification or were affected, and it has not told the public that every customer on its list was touched — the notice went to the customers whose information may have been affected. Customers learned of the incident on November 7, six days after the access was secured, because the information sat with a vendor the brand does not control and the scope had to be confirmed with that vendor first. The data that may have been viewed is: first and last names, email addresses, phone numbers, postal addresses and the total amount each customer had spent with the company. The company says payment information, order details and passwords were not part of the data accessed.
How serious
No passwords and no payment data were exposed, so this data set on its own does not open customer accounts or drain cards. The concrete risk is targeted phishing and smishing: a name, email address, phone number and postal address, together with a real total-spending figure, is enough for a scammer to pose as the brand with a believable refund, delivery or loyalty-reward lure — and to rank high-spending customers first. The company’s “no evidence of misuse” covers only the short window since the access was found; if the list was copied, scam messages quoting real customer details could arrive weeks later, when the warning has faded.
What to do now
Expect scam emails, texts and calls that mention Who Gives A Crap, a refund or a loyalty reward over the coming weeks, and treat any that arrive as unverified even when they use your real name or spending history — those details are exactly what may have been viewed. Do not click links in unsolicited messages; go to the company’s website by typing the address yourself. Never share one-time codes or card details with anyone who contacts you first. Checking your bank and card statements stays a sensible routine even though the company says payment data was not exposed. There is no password change to make for this incident, because the company says passwords were not accessed and accounts were not compromised. Australian customers can report suspected scams through Scamwatch, and anyone who thinks their identity is being misused can contact IDCARE, the national identity and cyber support service.
Sources: Tech Insider, “Who Gives A Crap Data Breach: 3 Countries,” November 7, 2026 (carrying the company’s notice and ABC reporting) · SSBCrack News, “Who Gives A Crap Customers Notified of Potential Data Breach Amid Cyber Security Incident,” November 7, 2026