Customers of the Australian toilet paper brand Who Gives A Crap in Australia, the United Kingdom and the United States have been told their personal details were accessed without authorisation in a breach at one of the company's marketing software suppliers.

The company began emailing affected customers late on Saturday 7 November 2026. According to its account, reported by ABC News and Cyber Daily, the unauthorised access began on 30 October at a US-based marketing software provider, was detected on 31 October and was contained by 1 November. The supplier told Who Gives A Crap about the incident on 6 November, and customer notifications began the following day.

What was exposed

The records involved hold each customer's first and last name, email address, phone number, mailing address and a running total of what they have spent with the brand. The company says payment information, order details and account passwords were not part of the data, and customer accounts on its own website were not directly accessed. Canadian customers were not affected, according to the provider.

Chief executive Simon Griffiths signed the customer notification, writing that certain personal information was accessed without permission during a security incident involving one of the company's marketing software vendors. The company says it has disconnected the affected provider and rotated access credentials.

Key questions still open

Several important facts remain unconfirmed. The company has not named the marketing software provider, has not said how many customers received the notification, and says it does not yet know whether anyone copied or downloaded the data. No criminal group had claimed the attack at the time of writing, and no fraud or identity theft linked to the incident has been confirmed. The company says there is no evidence of misuse so far.

The five-day gap between the provider securing its systems on 1 November and telling its customer on 6 November is likely to draw scrutiny, since the retailer could not warn anyone in that period. The reports do not explain the delay, and the company has not said whether it has reported the incident to regulators, including the UK Information Commissioner's Office, although it says it will engage with the relevant regulators as required.

The vendor risk lesson

The incident fits a familiar pattern in which attackers reach customer data through a supplier rather than the brand itself. Marketing platforms hold copies of customer lists, enriched with spending history, so they can send email and text campaigns and split audiences into groups. Because they do not process card numbers, they often receive less security scrutiny than payment systems, yet they hold exactly the contact data that makes phishing messages convincing.

For customers, the immediate risk is targeted fraud rather than direct financial loss. A message that uses a real name, home address and genuine purchase history passes the first test of credibility, so the company has urged customers to treat unexpected emails, texts, calls and letters claiming to be from it with caution, and to go to its website directly rather than following links. For other retailers, the lesson is to map every third-party platform that receives customer data, limit the fields each one gets, and set a short, specific deadline in supplier contracts for notification of incidents.