Australian recycled toilet-paper company Who Gives a Crap says an unauthorized party accessed customer data held by one of its marketing software providers, a U.S.-based firm it has not named, ABC News in Australia reported Saturday. The incident is a reminder that customer lists shared with marketing tools carry the same risk as data kept in-house.
What Happened
According to the company, the access began Oct. 30, was identified the next day and was contained Nov. 1. Cyber Daily, an Australian security publication, reported that the vendor told Who Gives a Crap on Nov. 6 and that customer emails began going out late Nov. 7.
The company says the exposed information covers customers in Australia, the UK and the U.S.: first and last names, email addresses, phone numbers, mailing addresses and the total amount each customer has spent with the brand. It says Canadian customers' data was not accessed, and that payment details, order details and passwords were not involved. Customer accounts were not directly accessed, the company says.
Who Gives a Crap has not said how many people were affected and does not yet know whether the data was copied or downloaded. Chief Executive Simon Griffiths apologized and said there was "no evidence of misuse so far," according to ABC. The company says it has disconnected the provider from its systems, changed access credentials and will engage regulators as required. Cyber Daily reported that no hacking group had claimed responsibility.
Why It Matters
Names, addresses and spending totals are low-sensitivity on their own, but together they let a scammer pose convincingly as the brand. The company urged customers to treat unexpected emails, texts, calls and letters with caution and to verify any message claiming to come from it.
For executives, the lesson is about vendors. Marketing platforms often hold a company's full customer list, and a single breach there can reach many client brands at once. Leaders should know which providers hold customer records, what fields each receives and how quickly contracts require breach notice. In this case, about five days passed between containment and the vendor's notice, by the company's account.
What to Watch
Watch whether the vendor is named, whether other brands disclose related incidents and whether the company reports a customer count or regulatory filings in the three affected countries.
