Who Gives A Crap told customers on 7 November 2026 that a US marketing-software provider had unauthorised access to some of their personal information. The catalog entry records a confirmed vendor incident, not a break-in of the brand's own shop accounts. Access began on 30 October, was found on 31 October, and was stopped on 1 November. The company was told on 6 November. Names, emails, phone numbers, mailing addresses and total spend may have been viewed. Payment cards, order details and passwords were not in the file, the company said. There is still no public headcount.
Chief executive Simon Griffiths said some customer information was accessed without authorisation at one of the firm's marketing software providers. Systems holding data from the Australian, UK and US stores were in scope. The provider reported that Canadian customer data was not accessed. Griffiths said the company does not yet know whether the information was copied or only viewed. That gap matters. A viewed screen and an exported spreadsheet are different risks.
What happened in the Who Gives A Crap data breach?
This is a third-party incident. Who Gives A Crap sells toilet paper and household paper online. Like many direct-to-consumer brands, it sends customer lists to a marketing platform for email and similar campaigns. An unauthorised party reached that provider, not the customer's login on the Who Gives A Crap site. The company said those shop accounts were not accessed and remain secure.
The timeline is short and specific. Unauthorised access started on 30 October 2026. The provider identified it on 31 October and secured it on 1 November. Who Gives A Crap learned of it on Friday 6 November and emailed possibly affected customers the next day. ABC News carried the statement on 8 November. The vendor has not been named in the public notice. Other brands on the same platform would not know to check.
Who Gives A Crap said it disconnected the provider completely and changed access credentials. It is talking to the provider about the investigation and said it will engage regulators as required. It also said it has no evidence of misuse so far. That describes what it has seen, not a promise about later phishing.
Vendor marketing leaks sit in the same family as the ARARA Message email-platform incident in Japan the same week, where the census was unique addresses on a mailer rather than a shop database. They are not the same vendor. The comparison is only that customer contact lists often live outside the brand that collected them. See also DigiCert's archived-system exposure for another case where a non-production store of customer records was the thing that leaked.
What data was exposed?
The company listed five fields: first and last names, email addresses, phone numbers, mailing addresses, and the total amount each customer had spent with Who Gives A Crap. Payment details were not involved. Order details were not involved. Passwords were not involved.
Those five fields are enough to write a convincing message. A scammer can open with the right name, mention a city from the mailing address, and hint at how much someone has spent on recycled paper. That is useful for phishing even when it cannot open a bank account on its own. Total spend is a loyalty signal. It is not a card number, and it is still something most customers do not expect to see in a stranger's spreadsheet.
The company used "may have been accessed" rather than a claim that every customer on every list was taken. It has not said how many people received the email. Until a census is published, do not treat social posts that invent a million-customer figure as a filing.
Who is affected by the Who Gives A Crap leak?
Customers of the Australian, UK and US stores whose records sat with the unnamed marketing provider. Canadian customers are outside the provider's report, according to the company. People who only browsed and never bought may or may not be in a marketing list. The notice went to people the company thinks may be in scope, not to the whole internet.
If you shopped Who Gives A Crap in those three countries and you received the Saturday email, treat yourself as in scope. If you did not get an email, you may still be in an unmatched set. The public statement is the record until a regulator posts a number. Similar contact-only notices, such as the M1 Singapore customer notice, also shipped without a headcount in the first 24 hours.
What should I do after the Who Gives A Crap notice?
- Read the email from Who Gives A Crap. Do not call a number in a second message that claims to be "WGAC security."
- Log in only by typing the official site or using the official app. The company said accounts were not accessed. Still change the password if you reused it on the marketing inbox that received the notice.
- Treat unexpected mail, texts and calls about refunds, "compromised orders" or carbon-offset prizes as hostile. The leaked spend total makes those scripts easier.
- You do not need a credit freeze solely because a toilet-paper brand leaked an address and a spend figure. You do need one if a later update adds government IDs or payment fields.
- Keep the email. If the company later names the vendor or publishes a count, that update is what a bank or privacy regulator will want to see.
The Vanguard Vermont notice post is a reminder that a short official letter is still the document that defines your rights, not a forum screenshot.
Frequently asked questions
Were payment cards stolen?
No, according to the company. Payment details, order details and passwords were not involved. Shop accounts were not directly accessed.
How many customers were affected?
Who Gives A Crap has not published a number. Do not trust a round figure that appears only on social media.
Which countries are in scope?
Australia, the United Kingdom and the United States. The provider said Canadian customer data was not accessed.
Who is the vendor?
The public statement does not name the US marketing-software provider. Other clients of that provider cannot check themselves until a name is published.
Was this a ransomware attack?
The company has not described ransomware, a leak site, or a named group. It described unauthorised access at a marketing provider.
Sourcing note: field lists, dates and the Canada exclusion come from the CEO statement as reported by ABC News. We will update this post if Who Gives A Crap names the vendor or publishes a census.