Hackers Expose Who Gives A Crap Customer Data Through Third-Party Breach

"We don't yet know whether the information was copied or downloaded," the company told customers.

Who Gives A Crap: what the company disclosed

Toilet paper retailer Who Gives A Crap told affected customers in an email that an intruder accessed personal information through a third‑party marketing software provider. The company said the incident followed a security event at an unnamed US‑based marketing software supplier. Who Gives A Crap also said it had found no evidence of misuse of the exposed information so far, and that it is "engaging with the relevant regulatory authorities, as required." Co‑founder and CEO Simon Griffiths confirmed the incident affected customers across the company's Australian, UK, and US stores.

The unnamed US marketing software provider: a short timeline and unanswered questions

According to the disclosure seen by The Register, the supplier reported the intruder gained access to its systems on October 30. The provider spotted the intrusion the following day, October 31, and says it secured its systems by November 1. Who Gives A Crap was not told about the incident until November 6. The supplier has not been publicly identified, did not disclose how many customers were affected, and did not respond to The Register's questions; The Register noted it was unclear why the supplier waited five days before informing Who Gives A Crap.

What data was exposed — and what was not

Who Gives A Crap's customer notice said the exposed information included customers' names, email addresses, phone numbers, mailing addresses, and total spending with the company. The company explicitly stated that payment information, order details, and passwords were not involved and that customers' accounts were not directly accessed. Nonetheless, the company acknowledged the key unresolved point: it does not yet know whether the accessed information was copied or downloaded.

Regulatory posture and public statements

Who Gives A Crap said it is engaging with the relevant regulatory authorities as required. In the UK, the Information Commissioner's Office (ICO) told The Register: "We can confirm Who Gives A Crap Limited has reported an incident and we are assessing the information provided." The supplier that the company blamed for the exposure reported that no personal information belonging to Canadian shoppers was accessed.

What this means for customers, procurement teams, and technologists

• Customers: Who Gives A Crap is warning affected shoppers to watch for suspicious emails, texts, calls, and other unsolicited communications. The company highlighted that "the main concern is scam or phishing messages that use your real details to look convincing."
• Procurement teams and commercial buyers: the provider at the center of the incident remains unnamed and did not answer questions, and Who Gives A Crap says it was not informed until November 6 despite the supplier saying it had secured systems by November 1 — factors that raise questions about vendor notification practices and transparency.
• Technologists and security teams: Who Gives A Crap said it has disconnected the provider from its systems and changed access credentials; it also reported no evidence of misuse so far but stated uncertainty about whether the data was copied or downloaded.

This incident leaves concrete items on the table: a clear timeline of the supplier's own containment (access on October 30, discovery October 31, systems secured by November 1) and a later notification to the customer on November 6; a defined set of exposed fields that exclude payments, order details and passwords; and an unresolved question central to impact assessment — whether the data was exfiltrated. The supplier's identity and the overall number of affected customers remain undisclosed.

With regulators assessing the report and the retailer taking immediate technical and customer‑notification steps, the next tangible disclosures to watch will be whether the supplier is named, whether evidence emerges that the accessed data was copied or downloaded, and how many customers in each country were affected.

Original report: https://www.theregister.com/security/2026/11/09/who-gives-a-crap-hackers-apparently-after-toilet-paper-makers-customer-data-exposed/5308419