Australian toilet paper company Who Gives A Crap has told customers that some of their personal information may have been accessed without permission in a security incident at one of its marketing software providers.

The company notified affected customers on Saturday, 7 November 2026. Customers in Australia, the United Kingdom and the United States were affected. The company said no personal data from Canadian customers was touched.

According to the company, the unauthorised access began on 30 October, was detected on 31 October and was secured by 1 November. The company's own systems and customer accounts were not the entry point. A marketing vendor holding a copy of the customer list was. The vendor has not been named in the material available to reporters.

The company lists five categories of information that may have been viewed: first and last names, email addresses, phone numbers, postal addresses and total spending with Who Gives A Crap. It says payment information, order details and passwords were not exposed, and that customer accounts were not directly compromised and remain secure.

Chief executive Simon Griffiths fronted the disclosure. In his statement he said: "Certain personal information of our customers was accessed without permission during a security incident involving one of our marketing software vendors." The company said it had cut its connections with the affected provider and changed access credentials, and that there was no evidence of misuse at this point.

The company has not said how many people received the notification email, and no headcount of affected customers has been published. The notice went to customers whose information may have been affected, and the company has not said that every customer on the list was touched.

[Source: tech-insider.org](https://tech-insider.org/au/who-gives-a-crap-data-breach-marketing-software-vendor-2026/) | [Source: ghanasummary.com](https://ghanasummary.com/international/who-gives-a-crap-confirms-customer-data-exposed-in-third-party-software-breach)