Who Gives A Crap has told customers in Australia, the United Kingdom and the United States that their personal details were reached without authorisation in a security incident at one of its marketing software providers. The Australian brand, best known for recycled toilet paper sold on subscription, began emailing affected customers on Saturday 7 November, and the story was reported widely on Sunday 8 November.

The intrusion did not happen on the retailer's own platform. It took place at an unnamed marketing software provider based in the United States, which held a copy of customer records for the company's Australian, UK and US stores. Who Gives A Crap says it has cut the provider off from its systems and changed access credentials.

According to the company's account, reported by ABC News and Cyber Daily, the unauthorised access began on 30 October, was detected on 31 October and was contained by 1 November. The supplier told Who Gives A Crap about the incident on Friday 6 November, and the brand started notifying customers the following day. Five days therefore passed between containment and the retailer learning of the breach, a gap the reports do not explain.

The records involved hold each customer's first and last name, email address, phone number, mailing address and a running total of what they have spent with the brand. The company says passwords, payment details and order details were not part of the data, and customer accounts on its own website were not directly accessed. Canadian customers were not affected, according to the provider, although the company has not said why.

Chief executive Simon Griffiths signed the customer notification. In the version quoted by ABC News, he wrote: "Some of our customers' personal information was accessed without authorisation in a security incident at one of our marketing software providers." He apologised in his statement and said the firm wanted to be "as clear as we can" with customers.

Several questions remain open. The company has not said how many customers were notified, has not named the supplier, and says it does not yet know whether anyone copied or downloaded the data. No criminal group had claimed the attack at the time of writing, and the company says it has seen no evidence of misuse so far. It says it will engage with the relevant regulators as required, but it has not said publicly whether the UK's Information Commissioner's Office has been told.

For customers, the immediate risk is targeted fraud rather than direct financial loss. A name, a home address, a phone number and a lifetime spending total together make a convincing lure: a scammer can quote real purchase history in a fake delivery message or a bogus loyalty offer. Anyone contacted out of the blue should go to the company's website directly rather than following links, and should never share card details or one-time codes in response to an unsolicited message.

For other retailers, the incident is a reminder about supplier risk. Under UK data protection law the retailer remains responsible for its customers' data even when the breach happens inside a supplier's systems, and a slow notification from a supplier eats into the time available to report it. Marketing platforms hold rich customer data but often receive less security scrutiny than payment systems, because they do not process card numbers. Who Gives A Crap's case shows that the data they do hold is still valuable to criminals.