- Ethical toilet paper company Who Gives A Crap exposes customer information following data breach
- Customers across UK, US and Australia affected
- Company warns users to be on their guard for scam or phishing attacks
Toilet paper firm Who Gives A Crap has told customers it has suffered a major data breach which leaked user information across three major markets.
In an email sent to customers seen by TechRadar Pro, the company apologized for the "unwelcome news" and promised to be "as clear as we can about what we know".
It noted that customers in its home country of Australia were affected, along with users in the UK and US - although users in its Canadian market were not affected.
"Unwelcome news"
"I’m writing to inform you that your personal information was accessed without authorisation in a security incident at one of our marketing software providers," the email told customers.
The company said it did not know whether the stolen information was copied or downloaded, but did say payment details, order details and passwords had not been affected.
In a seperate blog post, Simon Griffiths, Co-Founder & CEO, Who Gives A Crap, said it had been informed by an unnamed "US-based software provider" that an "unauthorized party" had accessed systems holding information from its online store.
"The provider has said that access began on 30 October 2026, was identified on 31 October 2026 and was secured on 1 November 2026," the company added.
Who Gives A Crap said it had disconnected the affected provider from its systems, and changed access credentials. It was also communicating with the affected provider to understand the details of their investigation in order to determine if there is any further action required, and said that it would be engaging with the relevant regulatory authorities as required.
"Your account with Who Gives A Crap is secure and was not directly accessed, so you don’t need to take any action with your account," it told customers, warning them that the main risks now would come from criminals sending out scam or phishing messages using their real details to look convincing.
"We have no evidence of misuse so far, but please be extra cautious," it added.
Mike Moore is Deputy Editor at TechRadar Pro. He has worked as a B2B and B2C tech journalist for over a decade, including at one of the UK's leading national newspapers and fellow Future title ITProPortal. When he's not keeping track of all the latest enterprise and workplace trends, he can most likely be found watching, following or taking part in some kind of sport.