2026 Who Gives A Crap — vendor data leak; names, contacts, spend
Data compromised
First and last names, emails, phones, mailing addresses and total amount spent. Payment details, order details and passwords not involved. Australia, UK and US store data in scope; Canadian customer data not accessed, the provider said. Whether data was copied is unpublished. Census unpublished. recordsAffected 0.
Technical writeup
CEO Simon Griffiths statement as reported by ABC 8 Nov 2026 (customer emails 7 Nov). No headcount. Catalogued as confirmed vendor incident, not a WGAC core-system breach.
Root cause
Unauthorised access at a US-based marketing-software provider. Access began 30 October, found 31 October, secured 1 November. WGAC was told 6 November. Vendor unnamed. WGAC cut the provider off and rotated credentials. WGAC accounts were not accessed.