Who Gives A Crap says a marketing provider exposed customer names and addresses

Who Gives A Crap, the Australian company known for recycled toilet paper and household paper, has told some customers that their personal information was reached in a security incident at a marketing software provider. The provider is based in the United States. The company has not named it.

What happened

ABC News reported on November 8 that customers whose information may have been accessed received emails on Saturday, November 7, and that a statement from chief executive and co-founder Simon Griffiths was posted after the company was told about the incident on Friday, November 6. Cyber Daily, which saw the customer email, dates that notice to late on November 7 and quotes Griffiths as writing: “I’m writing to inform you that your personal information was accessed without authorisation in a security incident at one of our marketing software providers.”

According to those reports, quoting the company:

• The access began on October 30, was identified on October 31 and was secured on November 1.
• Systems holding information from the Australian, UK and US stores were involved.
• The provider reported that no personal information from Canadian customers was accessed.
• The information involved was first and last names, email addresses, phone numbers, mailing addresses and the total amount spent with Who Gives A Crap.
• Payment details, order details and passwords were not involved.
• The company does not yet know whether the information was copied or downloaded.
• It said it has no evidence of misuse so far, and that customers’ Who Gives A Crap accounts were not directly accessed and remain secure.

Griffiths apologised. ABC quotes him saying, “I’m sorry this happened...Our team is doing everything we can to monitor the situation and strengthen our defences against breaches.” The company said it had disconnected the provider from its systems, changed access credentials, is talking with the provider about the investigation, and will engage with the relevant regulators as required. It also said it would update customers if it learned anything new that affected them or their data.

What this means for you

A name, an email address, a phone number, a mailing address and a spending total are enough to write a message that looks like it comes from the shop you already buy from. Someone could mention what you usually spend, or send a fake “order update” or refund offer to the address on file. Payment details were not part of this incident, according to the company, so this is not by itself a reason to replace a card. It is a reason to be careful with unexpected contact.

If you shop from Canada, the provider’s report, as relayed by the company, is that your information was not accessed. That is the provider’s account, not an independent audit published in these reports.

What you can do

1. If you received the company’s email, keep it as a reference for what it says was involved. Open Who Gives A Crap the way you usually do if you need to check an order, not through a link in a new message.
2. Treat unexpected emails, texts, calls and mail about an order, a refund or a prize as suspect, even if they use your name or address. The company asked customers to stay alert and to verify any communication claiming to be from it.
3. You do not need to change your Who Gives A Crap password because of this incident, based on what the company has said: passwords were not involved and customer accounts were not directly accessed. If you reused that password elsewhere, changing the other accounts is still good practice.
4. See how scammers use leaked data to make a message feel personal if a note arrives that mentions your address or what you spend.

How Frame helps

Add this breach to a verified email in Frame and Frame shows what it exposed, gives you a short checklist and counts it in your exposure report. Frame can also look up your verified emails in Have I Been Pwned’s breach database. Frame’s email aliases also let you give each shop its own address, so a fake message that arrives at the wrong one stands out. Frame never collects or stores the leaked records themselves.

Related coverage

• Coinbase says some customer contact details leaked through analytics vendor Amplitude: another case where a marketing or analytics vendor, not the company’s own login, was the path.
• How scammers use leaked data to make phishing personal: what a name, an address and a spending total are worth to someone writing a fake shop message.

Sources

• ABC News, Who Gives A Crap confirms customer data exposed in software breach, November 8, 2026
• Cyber Daily, Aussie recycled toilet paper brand Who Gives a Crap discloses data breach, November 8, 2026