Who Gives A Crap breach exposed customer names, addresses and spending

By Amara Osei

Hackers stole names, email addresses, phone numbers, mailing addresses and total spending amounts from customers of Australian toilet paper maker Who Gives A Crap in a third-party cyberattack detected on 31 October.

The breach hit a marketing software firm that stored the customer data. Who Gives A Crap was reportedly notified on 6 November — six days after the provider detected the intrusion. The company said no payment details or passwords were accessed. The breach affected customers in Australia, the UK and the US; the exact number of affected individuals has not been disclosed.

The company has since cut the provider off and changed access credentials. It found no signs that customer data had been misused, and it is investigating whether files were copied or downloaded. SmartCompany contacted Who Gives A Crap for comment but had not received a response by publication.

Why does the data matter to criminals?

Troy Hunt, the cybersecurity expert behind the breach notification service Have I Been Pwned, said the exposed data gives attackers the raw material for targeted phishing scams.

“If you can send someone an email and you know their phone number and where they live, and then of course you know the product they’re buying because they’re in this particular data breach, you can tailor a phishing attack to be much more specific to that individual,” Hunt told SmartCompany.

He also questioned why a marketing firm would hold customers’ physical addresses, phone numbers and spending amounts in the first place.

What does the breach reveal about third-party risk?

Hunt said businesses increasingly rely on external providers for marketing, payments and customer service, and every provider adds a point of exposure. His own three-person business uses separate providers for payments, accounting, email and customer service.

“By the time you get to a large organisation, they’ve got so many different potential points of risk with external providers that it’s not at all surprising that we see the number of data breaches we do,” he said.

His advice is blunt: share less. Limiting the information handed to suppliers is the most practical way to shrink the damage when a breach happens.

“If you do have a data breach, how do you minimise its impact? Well, less data,” Hunt said.

He also urged companies to review how long third parties retain customer records. “A lot of data breaches are much worse because people are sitting on data that’s been there for well beyond its useful period.”

Who takes the reputational hit?

Hunt pushed back on breach notices that attribute an incident to an outside vendor. Customers entrusted their information to Who Gives A Crap, not to its supplier, he argued.

“It is a little bit of a, ‘Hey, we didn’t get breached, someone else did,’ when you see that in a notice,” Hunt said. “Doesn’t really change anything to customers.”

“They entrusted their data to Who Gives A Crap. They’ve then put that data with another party, and they have to account for it,” he said.

The financial exposure goes beyond reputation. Hunt warned that litigation increasingly follows breaches. “These days, it’s very much from class actions,” he said.

Is this the company's first tech stumble this year?

No. The breach comes four months after Who Gives A Crap suspended an AI-powered customer service tool. The tool had incorrectly told customers that prices would double.

The company's next disclosures — the outcome of its file-copying investigation and the still-undisclosed count of affected customers — will determine how much legal and reputational fallout lands on the brand rather than its unnamed supplier.