Who Gives A Crap? Toilet Paper Maker Exposes Customer Data Via Third-Party Vendor
Toilet paper company Who Gives A Crap has disclosed a data breach affecting customers in the UK, US, and Australia, stemming from a security incident at an unnamed third-party marketing software provider.
Who Gives A Crap, a popular direct-to-consumer toilet paper brand, is facing a data breach that exposed the personal information of its customers in the United Kingdom, United States, and Australia. The incident occurred on October 30 when an unauthorized party gained access to the systems of a US-based marketing software provider used by the company.
The breach was discovered by the vendor on October 31, who then secured its systems by November 1. However, Who Gives A Crap was not notified of the incident until November 6, leading to a delay in informing affected customers. The exposed data includes customer names, email addresses, phone numbers, mailing addresses, and total spending amounts. Crucially, payment information, order details, and passwords were not compromised, and direct access to customer accounts was not achieved.
In an email to customers, the company stated that it is still unclear whether the accessed information was actually copied or downloaded by the intruder. "We don't yet know whether the information was copied or downloaded," the company said, adding that there is currently no evidence of misuse. This uncertainty leaves customers vulnerable to potential phishing attacks and social engineering schemes.
Who Gives A Crap co-founder and CEO Simon Griffiths confirmed the scope of the breach, noting that Canadian customers were unaffected as their data was not accessed by the compromised provider. The company has taken immediate action by disconnecting the vendor from its systems and revoking access credentials. Affected customers are being advised to remain vigilant for suspicious communications via email, text, or phone.
The identity of the third-party software provider remains undisclosed, and the company has not provided details on the total number of customers impacted. Who Gives A Crap has stated it is cooperating with relevant regulatory authorities, and the UK's Information Commissioner's Office (ICO) has confirmed it is assessing the information provided.
This incident highlights the significant risks associated with third-party vendor relationships. Even when a company's own systems are secure, a vulnerability in a partner's infrastructure can lead to a data breach, exposing sensitive customer information. The delay in notification from the vendor further compounds the issue, underscoring the need for robust incident response protocols and clear communication channels throughout the supply chain.
Customers are urged to be cautious of any unsolicited communications that may use their personal details to appear legitimate. The company is working to mitigate further risks and provide support to those affected by this unfortunate data exposure.