If you have bought from Who Gives A Crap in Australia, the UK or the US, expect odd messages and treat them with suspicion. The toilet paper company told customers that a breach at one of its marketing software providers exposed their personal details. Customers in Canada were not affected.
The exposed data includes first and last names, email addresses, phone numbers, mailing addresses and the total each customer has spent with the company. Payment details, order details and passwords were not affected, the company said. It also said it does not know whether the data was copied or downloaded, only that it was accessed.
The company did not name the vendor. It described it only as a "US-based software provider". According to a blog post from co-founder and CEO Simon Griffiths, the provider said an unauthorized party got into systems holding information from the online store. Access began October 30, was identified October 31 and was secured November 1. Who Gives A Crap has disconnected the provider, changed its access credentials and said it will engage regulators as required.
The company says customer accounts were not directly accessed, so no action is needed there. The real risk is phishing, meaning fake messages built to trick you into handing over money or logins. A scammer who knows your name, address, phone number and roughly what you spend has enough to sound like the real company. The company said it has no evidence of misuse so far.
This follows a familiar pattern. The retailer's own systems held up, and the weak point was a supplier holding a copy of its customer data. Customers cannot audit a vendor they have never heard of, and the company has not yet said which one it was or how many people are affected.