Who Gives A Crap Breach Hits 3 Countries [2026]

Who Gives A Crap customers in Australia, the United Kingdom and the United States are being told that an unauthorised party reached their personal details through a US-based marketing software provider, according to ABC News. The Who Gives A Crap data breach exposed names, email addresses, phone numbers, mailing addresses and the total each customer has spent with the brand. Canadian customers were not affected.

The company says payment information, order details and account passwords were not involved. It also says it does not yet know whether anyone copied or downloaded the data. That gap between access and theft will drive most of the questions over the coming weeks, and it is the main reason this story matters beyond one recycled toilet paper brand.

Third-party exposure has become the default shape of a modern customer data incident. Recently we covered the DigiCert breach, where four contact fields of archived customer data were exposed, and the pattern is familiar: the data sits with a supplier, the supplier gets hit, and the brand writes the apology email. This analysis walks through the confirmed facts, the open questions, and what both customers and companies should do next.

What Happened in the Who Gives A Crap Data Breach

Cyber Daily describes Who Gives A Crap as an Australian recycled toilet paper brand. Like any online retailer, it keeps customer contact records in marketing tools, and that is exactly the kind of data that sat in the affected system.

According to the company’s disclosure as reported by ABC News, Cyber Daily and PerthNow, an unauthorised party gained access to customer information held by a US-based marketing software provider. The provider told Who Gives A Crap about the incident on November 6, 2026. Customer emails began going out on November 7, and media coverage followed on November 8.

The affected provider has not been named in any of the coverage we reviewed. Who Gives A Crap has also not published how many customers received the notification. Both details remain unconfirmed, and we treat them that way throughout this article.

Timeline: From the October 30 Intrusion to the November 7 Emails

The sequence of dates matters because it shows how long the data was exposed and how long it took the news to reach customers. PerthNow’s report and the company’s customer notice give the following dates.

Date (2026)	Event	Gap from first access
October 30	Unauthorised access to the marketing provider’s systems begins	Day 0
October 31	Provider detects the incident	1 day
November 1	Affected systems secured	2 days
November 6	Provider informs Who Gives A Crap	7 days
November 7	Who Gives A Crap begins notifying customers	8 days
November 8	Story reported by ABC News, PerthNow, Cyber Daily and others	9 days

Two intervals stand out. The provider detected the intrusion one day after it began. Then five days passed between the provider securing its systems on November 1 and telling its customer on November 6. The reports do not explain that gap, so we will not guess at its cause. A forensic review, a legal review or a slow escalation path could each produce the same delay.

Once Who Gives A Crap had the news, it moved fast. Customer emails went out the next day. For a brand with customers in three countries, a one-day turnaround from vendor notice to customer notice is a point in its favour.

Which Customers Are Affected Across Three Countries

The company says customers in Australia, the United Kingdom and the United States were affected. UK-focused outlet SecNews framed the story around British customers, while Australian outlets including ABC News, PerthNow and Cyber Daily covered the home-market angle. 7NEWS and SSBCrack also carried the story.

Canada is the exception. Reports say Canadian customers’ data was not accessed. The company has not said why, and the reports do not say. A plausible reading is that Canadian marketing data lives in a different system or region, but that is analysis, not a confirmed fact.

No one has published a total headcount. That matters because the size of a breach drives regulator interest, class action risk and the scale of any phishing wave that follows. Until the company or a regulator discloses a number, any figure circulating online should be treated as a guess.

What Data Was Exposed and What Was Not

The exposed set is a classic marketing profile. The newsletter Red Flag Cyber summarised it as customer names, contact details and spending totals that may have been accessed through a marketing-software provider. The company’s own list is more specific, and we have put it side by side with the items it says were not touched.

Data type	Potentially exposed?	Source of the claim
First and last name	Yes	Company notice
Email address	Yes	Company notice
Phone number	Yes	Company notice
Mailing address	Yes	Company notice
Total amount spent with Who Gives A Crap	Yes	Company notice
Payment information	No, per the company	Company notice
Order details	No, per the company	Company notice
Account passwords	No, per the company	Company notice

The not-exposed column rests on the company’s word. No independent party has audited it in public. That does not make the claim doubtful, but readers should know where the evidence stops. The exposed list, by contrast, is what the company itself admits to, so it is a floor, not a ceiling.

The spending total deserves attention. A name and an email are common currency on the criminal market. A name, a home address, a phone number and a lifetime spend figure together make a much better lure, because a scammer can reference real purchase history to sound credible.

What Who Gives A Crap Still Does Not Know

The company has been candid about its limits. It says it does not know whether customer information was copied or downloaded. In incident response terms, that is the difference between an access event and an exfiltration event, and the two carry very different consequences.

Here is what remains unconfirmed, based on the fact set we hold and the coverage we read:

The name of the marketing software provider.
The number of affected customers.
Whether any data was copied, downloaded or misused.
Whether any fraud or identity theft has occurred as a result.

Logging is usually the deciding factor. If the provider kept detailed audit logs of what the intruder queried and exported, it can answer the copy question quickly. If it did not, the honest answer stays that nobody can rule it out, and customers have to plan around the worst case.

What Simon Griffiths Told Customers

Simon Griffiths, co-founder and CEO of Who Gives A Crap, signed the customer notification. The wording below comes straight from the email as quoted by Cyber Daily. Griffiths wrote: “I’m writing to inform you that your personal information was accessed without authorisation in a security incident at one of our marketing software providers.”

The same Cyber Daily report quotes him describing the data involved: “The personal information involved was your first and last name, email address, phone number, mailing address and the total amount you’ve spent with Who Gives A Crap.”

ABC News quotes a slightly different version of the notice, in which Griffiths says: “Some of our customers’ personal information was accessed without authorisation in a security incident at one of our marketing software providers.” The two phrasings likely reflect different versions of the notice for different regions or audiences, though neither outlet explains the difference.

The tone is plain and the first sentence tells the customer what happened. That matters. Breach notices that bury the admission under paragraphs of reassurance tend to draw sharper criticism than notices that lead with the fact. Whether the rest of the response holds up depends on the follow-up, which the company has not yet published.

How the Company Responded

Who Gives A Crap says it disconnected the affected provider from its customer systems and changed access credentials. Those are the two standard first moves in a vendor compromise. Cutting the integration stops any further data flowing to the compromised party, and rotating credentials closes the door for anyone holding stolen keys.

Our earlier report on the DreamHost breach, where under 10 percent of accounts were hit and passwords were reset, shows the same playbook at a hosting company. Credential rotation is cheap and fast. The harder work is the investigation that follows, which has to establish what the intruder actually touched.

What the company has not said is whether it will keep the provider, replace it, or change what data it shares with marketing tools. Those decisions will show how seriously it treats the root cause, and customers will notice if the same vendor reappears in a few months.

Why Marketing Software Vendors Are Attractive Targets

Marketing platforms hold more personal data than most people expect. They sync customer lists from the storefront, enrich them with spending history and use them to send email, SMS and ads. Every one of those functions needs names, contact details and purchase totals, which is precisely the set that leaked here.

Concentrated Data, Thin Defences

A single marketing vendor may serve thousands of brands. A successful intrusion there pays out many times over, because one set of stolen credentials or one unpatched flaw opens many customer databases at once. Attackers know this, and they plan around it.

Marketing tools also tend to receive less security scrutiny than payment or identity systems. Because they do not process card numbers, they often skip the strict controls that apply to payments. That leaves a rich data store behind lighter defences.

The Perimeter the Brand Cannot See

A retailer can harden its own storefront and still lose customer data through a partner. Who Gives A Crap says its provider informed it of this incident on November 6. That is the core weakness of vendor risk: the brand depends on the supplier to notice, to tell the truth and to tell it quickly.

Security teams can narrow that blind spot with continuous scanning and log aggregation across their supplier connections. Our roundups of the best vulnerability scanning tools for lean security teams and of SIEM platforms compared cover the tooling that helps small teams watch what vendors can reach.

Spending Totals and the Phishing Risk

The immediate danger for customers is not stolen money. The company says no payment data was involved. The danger is a convincing message from someone who knows who you are, where you live and roughly how much you buy.

Consider how a scam might look. A text claims to come from Who Gives A Crap and says a delivery to your street address failed. It asks you to confirm your details on a link. Because the sender used your real name and address, the message passes the first sniff test. The spending total helps with upsell scams, where a fake loyalty reward refers to your history.

Phone numbers raise the stakes further. SMS and voice scams ride on trust, and a caller who recites your suburb and first name sounds legitimate. This is why the company’s advice to stay alert matters even though the confirmed harm so far is zero. No fraud or identity theft has been confirmed, but the conditions for it now exist.

How This Breach Compares With Other Recent Incidents

Context helps size the problem. The table below sets this incident beside several we have covered on Tech Insider, using the headline figures from those reports. We chose cases that share a feature with this one, such as contact data exposure, reset-based containment or a widening scope.

Incident	Headline figure in our coverage	Read-across to Who Gives A Crap
Who Gives A Crap (Nov. 2026)	3 countries, 5 data fields, no confirmed count	Vendor-side compromise, copying unconfirmed
Mirae Asset Securities	35,255 staff, 3,800 customers	Published counts, unlike here
DigiCert	4 contact fields of archived customer data	Contact data again the core exposure
DreamHost	Under 10 percent of accounts, passwords reset	Credential reset as the first containment step
mSecure	3 reset warnings to users	Users told to act after a vendor-level event
Perry Johnson	13.3 million people, 10 million dollar settlement	Shows how large the cost can grow later

The sharpest contrast is disclosure depth. Mirae Asset published counts for staff and clients. Perry Johnson‘s case reached a settlement figure and a headcount in the millions. Who Gives A Crap has neither yet. That is normal for a story that is two days old, but readers should expect pressure for numbers as the investigation matures.

Market Impact and Historical Context

Who Gives A Crap is a private company, so there is no share price to track and no market reaction to measure. The impact shows up elsewhere: in customer trust, in the vendor review calendars of other direct-to-consumer brands, and in the spending decisions of marketing and security teams.

The trust question still bites. Customers tend to forgive a vendor failure when the brand tells them quickly and plainly. They are far less forgiving of a slow or vague follow-up, and Who Gives A Crap has not yet published one.

For the wider industry, the historical pattern is steady. Security teams spent the past several years hardening their own perimeters, and attackers responded by moving to the suppliers that hold copies of the same data. Marketing, support and analytics vendors now sit among the most common entry points for customer-data incidents. Our cybersecurity coverage has tracked that shift through the DigiCert, DreamHost and Chainalysis stories, and this one fits the same line.

What Customers Should Do Now

Even with no confirmed misuse, a few steps cost almost nothing and cut real risk. The advice below follows the standard guidance for contact-data exposures and the points raised in the coverage.

Five Steps for Affected Customers

Treat unexpected emails, texts and calls that mention Who Gives A Crap with suspicion, even if they use your real name.
Never share passwords, card details or one-time codes in reply to an unsolicited message.
Contact the company through its official website or a number you already trust, not through links in any message.
Change any password you reuse across sites, even though the company says account passwords were not exposed.
Turn on multi-factor authentication for your email, shopping and banking accounts, and glance at statements for odd charges.

Also consider whether the phone number the company holds is one you want scammers to have. If you can, register it with your national do-not-call service and let unknown callers go to voicemail for the next few weeks.

A Vendor Risk Checklist for Companies

Other brands should read this incident as a prompt, not a curiosity. Any company that pipes customer data into a marketing platform has the same exposure. A practical checklist looks like this:

Minimise what you share. Send only the fields a campaign needs. A spending total can be useful for segmentation, but ask whether the vendor needs a home address.
Demand fast notice in the contract. Set a clear window for the vendor to tell you about an incident after detection, and test that the channel works.
Hold the vendor to log retention. Without audit logs, nobody can answer the copy question, as this case shows.
Keep a kill switch. Know how to disconnect each integration and rotate its credentials within hours. Who Gives A Crap did both.
Rehearse the customer message. Draft the notification template before you need it, and decide who signs it.

None of this removes the risk. It shrinks the blast radius and shortens the time between a vendor’s problem and your customers’ protection.

Predictions: What Comes Next

These are our analysis and judgement, not reported facts. We have stated each with the reasoning behind it.

The provider will be named within weeks. A US vendor serving multiple brands will likely face disclosure pressure from other customers, regulators or the press, and names tend to surface once more than one client is involved.
More brands will report the same incident. If the provider serves other retailers, expect similar notices. A single brand’s disclosure is often the first of several.
A customer count will emerge. Regulators in the affected countries and journalists will ask for one, and a published figure usually follows within a month or two.
Targeted phishing will appear. Contact data with spending totals is valuable to scammers, so expect at least some reports of lures that reference the brand.
Marketing vendors will face tougher questionnaires. Procurement and security teams at other brands will tighten reviews of any vendor that stores customer lists.

Frequently Asked Questions

What happened in the Who Gives A Crap data breach?
An unauthorised party accessed customer information held by a US-based marketing software provider. The company disclosed it to customers on November 7, 2026, after the provider informed it on November 6.

Which customers are affected?
Customers in Australia, the United Kingdom and the United States. The company says Canadian customers’ data was not accessed.

What personal information may have been exposed?
First and last names, email addresses, phone numbers, mailing addresses and the total amount spent with Who Gives A Crap.

Were my payment details or password stolen?
The company says payment information, order details and account passwords were not involved. That statement comes from the company, and no independent audit has been published.

Was my data copied or misused?
Nobody knows yet. Who Gives A Crap says it does not know whether the information was copied or downloaded, and no fraud or identity theft has been confirmed.

Which marketing software provider was hacked?
The provider has not been named in the coverage we reviewed. We will not guess, and readers should be wary of unverified names circulating on social media.

What should I do if I get a suspicious message?
Do not click links or share codes. Go to the company’s official website or a trusted contact detail and verify directly, and report the message to your local scam reporting service.