Who Gives A Crap has told customers in the UK, Australia and the US that their contact details and total spend were accessed without authorisation in a breach at one of its marketing software suppliers. No payment data was involved, but the incident is a reminder that your customer list is only as safe as the least secure tool you share it with.
What happened
Who Gives A Crap, the Australian brand best known for recycled toilet paper sold on subscription, began emailing customers late on Saturday 7 November 2026 to warn them that their personal information had been accessed without permission. The intrusion did not happen on the retailer’s own platform. It took place at an unnamed marketing software provider based in the US, which held a copy of customer records for the company’s Australian, UK and US stores.
According to the company’s account, reported by ABC News and Cyber Daily, the unauthorised access began on 30 October, was detected on 31 October and was contained by 1 November. The supplier told Who Gives A Crap on Friday 6 November, and the brand started notifying customers the following day. Chief executive Simon Griffiths apologised in his statement and said the firm wanted to be “as clear as we can” with customers.
The records involved hold each customer’s full name, email and postal addresses, phone number and a running total of what they have spent with the brand. The company says passwords, payment details and order details were not part of the data, and customer accounts on its own website were not directly accessed. According to the provider, no Canadian customers’ data was reached.
Key questions remain open. The company cannot yet say whether the data was copied, has not said how many customers were notified and has not named the supplier. No criminal group had claimed the attack at the time of writing.
The technical picture
Few technical details have been released. This was a third-party compromise: the attacker reached a store of customer data held by a marketing platform, not the retailer’s e-commerce systems. Who Gives A Crap says it has fully disconnected the provider and rotated access credentials, which suggests there was an integration (typically an API key or connector token) feeding customer data from the shop into the marketing tool.
The list of exposed fields fits that picture. A campaign tool exists to send messages and split audiences into groups, so it was given contact and value data, while payment and credential data stayed with the shop. That separation is the main reason this incident is not far worse.
The cumulative spend total is what I would worry about. Contact data on its own is common in breach notices; a monetary value attached to each person is less so. It allows whoever holds the records to sort them and target the biggest customers first, the customers likeliest to trust a message dressed up as the brand. Combined with a home address and mobile number, that supports email, text and letter-based fraud alike.
By the company’s account, the supplier contained the intrusion about two days after it began, a reasonable response. Telling the retailer took longer: five days passed between containment on 1 November and notification on 6 November, leaving Who Gives A Crap unable to warn anyone.
Why it matters for UK organisations
For UK customers the immediate risk is targeted fraud rather than direct financial loss. Anyone on the list should expect messages that use their real name, address and some knowledge of their purchases. The company itself has urged customers to treat unexpected emails, texts, calls and post with caution.
For UK businesses, the bigger lesson is about who is responsible. Under UK GDPR the retailer remains the controller of its customers’ data, even when the breach happens inside a processor’s environment. The controller’s duty to report a notifiable breach to the ICO within 72 hours runs from when the controller becomes aware of it, so a slow notification from a supplier eats directly into that time. Who Gives A Crap says it will engage with the relevant regulators as required; it has not said publicly whether the ICO has been told.
Many UK retailers, charities and subscription firms run this setup: a shop connected to email, SMS, customer data and loyalty tools. Each connection is another copy of the customer list, often with broad permissions and little monitoring.
Expert view
In my experience, marketing technology is one of the least scrutinised parts of a retailer’s estate. When we assess e-commerce environments, the storefront and payment flow usually get the attention, while connectors to email and analytics platforms sit with long-lived keys, full read access to customer records and no one reviewing who can log in to the vendor console.
What Who Gives A Crap got right is data minimisation: card data and passwords were never in the marketing platform, so they could not leak from it. What should worry other brands is the unnamed vendor. If several retailers use the same provider, they cannot check whether they are affected until that provider tells them. In my view, a supplier contract that does not set a short, specific deadline for notifying you of incidents is a gap that needs closing now, not at renewal.
I would also caution against reading too much into the company’s statement that it has seen no evidence of misuse so far. Barely a week has passed since the intrusion, and harvested customer records can take months to reappear in scam campaigns. Until the investigation shows otherwise, I would plan on the basis that the records were taken.
What to do now
- If you are a customer: be wary of any message that mentions your order history, refunds or account problems. Go to the company’s website yourself rather than following links, and never share card details or one-time codes in response to an unsolicited contact.
- Map your data flows: list every third-party platform that receives customer data, which fields it gets and how (API keys, exports, connectors).
- Minimise the fields: remove anything a marketing tool does not genuinely need. Spend bands rather than exact totals, and no dates of birth or full addresses unless they are needed for postal campaigns.
- Tighten access to vendor consoles: enforce MFA and single sign-on for staff logging into SaaS marketing tools, remove leavers promptly and review admin roles. This maps directly to the Cyber Essentials user access control requirement.
- Rotate and scope integration keys: replace long-lived API tokens, restrict them to the minimum permissions and record who owns each one. Treat this as part of secure configuration.
- Fix your contracts: require processors to notify you of incidents within a set number of hours, share logs and support your ICO reporting. Check your breach response plan accounts for supplier-originated incidents.
Bottom line
This breach exposed no cards or passwords, but it may have given an unknown party up-to-date records of genuine UK customers, complete with addresses and what each has spent. The retailer stays accountable for that data wherever it is held. If your customer list sits in half a dozen SaaS tools, each one needs the same care as your own database.
