Who Gives A Crap data breach

What happened

Who Gives A Crap, the Australian recycled toilet paper and household paper brand, began emailing customers late on November 7, 2026 to say their personal information was accessed without authorization in a security incident at one of its marketing software providers. The unnamed US-based provider says access began on October 30, was identified on October 31 and was secured on November 1; it told Who Gives A Crap on November 6. The data involved is first and last name, email address, phone number, mailing address and the total amount a customer has spent with the company. Payment details, order details and passwords were not included, and the company says customer accounts were not directly accessed. Customers in Australia, the UK and the US are affected; Canadian customers are not. The company says it doesn't yet know whether the data was copied or downloaded, has found no evidence of misuse so far, has disconnected the provider and changed access credentials, and has not said how many customers are affected.

What should I do?

1. Be wary of emails, texts and calls claiming to be from Who Gives A Crap or a delivery company, especially ones that quote your name, address or how much you've spent.
2. Don't click links or pay invoices in unexpected messages about orders, subscriptions or refunds; go to the company's website directly instead.
3. Expect more targeted spam and scam calls to your phone number and email address, and don't confirm personal details to callers.
4. Watch your post for scam letters sent to your mailing address.

More data breaches in Australia →

Check the other services you use →