Australian-based toilet paper company Who Gives A Crap has confirmed that customer information was exposed following a cyber security incident involving one of its third-party software providers.
According to reports, the incident began on 30 October 2026, with the software provider detecting the compromise on 31 October and securing its systems by 1 November. Who Gives A Crap was reportedly not notified until 6 November.
What information was exposed?
The exposed customer information reportedly included:
- First and last names
- Email addresses
- Phone numbers
- Mailing addresses
- Total spending with Who Gives A Crap
The company has confirmed that payment details, order information and account passwords were not exposed. Customer accounts were also not directly accessed.
Customers in Australia, the UK and the US were reportedly affected, while Canadian customer information was not impacted. The total number of affected customers has not yet been disclosed.
Company response
Who Gives A Crap says it has disconnected the affected software provider from its systems and changed access credentials. The company is continuing to investigate whether customer information was copied or downloaded during the incident.
Although there is currently no evidence of customer data being misused, the exposed information could be used to support targeted phishing and impersonation campaigns.
Customers should remain vigilant for unexpected emails, SMS messages and phone calls, particularly communications referencing genuine personal information or previous purchases.
The incident is another reminder that organisations can suffer customer data exposure through compromises involving third-party suppliers, even when their own systems have not been directly breached.
Sources:
