Ethical toilet paper company Who Gives A Crap has disclosed a major security incident that exposed customer information across three major international markets. In an email communication sent out to affected shoppers, the company apologized for the unwelcome news and confirmed that personal information was accessed without authorization following a data breach at a third-party marketing software provider. The security event directly impacts customers located in the United Kingdom, the United States, and Australia, while users in the company's Canadian market remain completely unaffected.
Key takeaways
- Customer personal data was compromised across the UK, US, and Australia.
- Stolen data fields include names, phone numbers, mailing addresses, and purchase totals.
- Payment details, account passwords, and order details were not affected by the breach.
- Unauthorized system access began on October 30, 2026, and was secured by November 1, 2026.
Timeline and Nature of the Security Breach
According to separate disclosures released by Who Gives A Crap and its Co-Founder and CEO Simon Griffiths, the compromise originated from an unnamed US-based software provider that handled information originating from the online store. Company findings indicate that an unauthorized party gained entry to systems holding customer data starting on October 30, 2026. The vendor identified the unauthorized access the following day on October 31, 2026, and successfully secured the compromised environment by November 1, 2026.
The exposed information includes user first and last names, email addresses, phone numbers, mailing addresses, and the total amount the user had spent with Who Gives A Crap. The firm stated that it currently does not know whether the stolen information was actively copied or downloaded by the malicious actor. However, the company explicitly confirmed that sensitive financial information, including payment details, direct order details, and customer account passwords, remained completely uncompromised throughout the incident.
Company Response and Warnings for Customers
In response to the breach, Who Gives A Crap immediately disconnected the affected provider from its corporate systems and rotated access credentials to prevent further risk. The enterprise is currently in direct communication with the software vendor to understand the complete findings of their investigation and evaluate whether any further action is required. Additionally, the company confirmed it will engage with all relevant regulatory authorities as mandated by law.
Executives emphasized that customer accounts held directly with Who Gives A Crap were secure and were not directly accessed, meaning users do not need to take any action regarding their login credentials. Despite having no concrete evidence of data misuse so far, the company issued a stern warning for users to be on their guard. Because malicious actors obtained real personal details such as names, phone numbers, and physical addresses, criminals could leverage this information to craft convincing scam or phishing attacks targeting unsuspecting buyers.
Comments