Who Gives A Crap Says Marketing Vendor Breach Exposed Customer Names, Addresses and Spending

Who Gives A Crap says customer names, email addresses, phone numbers, mailing addresses and spending totals were exposed in a breach at one of its marketing software providers. Passwords and card details were not involved, but the information that was taken is exactly what a scammer needs to make a fake message look genuine.

The subscription brand, best known for its recycled and bamboo toilet paper, posted an incident notice on November 7 with a statement from co-founder and CEO Simon Griffiths. Customers of its Australian, UK and US stores are affected. According to the provider, no personal information from Canadian customers was accessed.

The timeline comes from that provider, a US-based software company the brand has not named. The unauthorized access began on October 30, was spotted by the provider on October 31 and was shut down on November 1. Who Gives A Crap learned of it on November 6 and emailed affected customers on November 7.

What the Who Gives A Crap data breach exposed and what it did not

The data covers first and last names, email addresses, phone numbers, mailing addresses and the total amount each customer has spent with the brand. Payment details, order details and passwords were not part of it.

Store accounts were not directly accessed, and the company says customers do not need to change anything about their logins. It reports "no evidence of misuse so far," but it does not yet know whether the information was copied or downloaded. The number of affected customers has not been disclosed.

Why a marketing software provider had Who Gives A Crap customer data

The provider used customer information to help the brand measure how well its marketing spend was working, according to the notice. Arrangements like that are routine in online retail, and they mean your details can sit with companies you have never heard of.

The pattern echoes the shipping-partner cyberattack that exposed data from Valve's European Steam hardware buyers in August. The store held up, but a partner holding its customer list did not. Who Gives A Crap says it has disconnected the provider completely, changed access credentials and stopped sending it customer information. It also says it will engage with regulators as required, and that orders and subscriptions continue as normal.

Why names, addresses and spending totals still matter to scammers

None of this lets anyone sign in to your account or charge your card. What it does allow is an email, text or letter that knows your name, your street address and roughly how much you buy. A message about a delayed delivery or a refund lands very differently when it gets those details right.

The notice makes the same point, warning that scammers can use real details to look convincing. Fakes do not need a suspicious-looking sender to work, either, as phishing messages sent from a real Microsoft address showed earlier this year.

What Who Gives A Crap customers should do after the breach notice

Start with the brand's own rules, because they make fakes easier to spot. Who Gives A Crap says it never asks for payment details by email or text, and it does not contact customers by phone. So a call claiming to be from the company, or an email or text asking for card details, should be treated as fake. The same goes for any request to share a code or password.

If a suspicious message arrives, do not click its links, reply or share anything. Check with the support team at [email protected] instead. Treat unexpected paper mail the same way, since mailing addresses were part of the exposed data.

To see, correct or delete what the brand holds about you, use the Manage My Privacy link in its website footer or write to [email protected]. Phone numbers and home addresses also circulate on data broker sites, so it is worth checking the people search websites that may already list yours.

The company says it will update its notice if anything new affects customers. Until it can say whether the data was copied and how many people it covers, treat any unexpected message about your order as suspect and verify it before you act.