Australian toilet paper and household goods company Who Gives A Crap (WGAC) has told customers that some of their personal information was accessed without authorisation. The access happened at one of its marketing software providers, a US-based company, in late October. Chief Executive Simon Griffiths said in a company statement that the exposed data covers customers' names, email addresses, phone numbers, mailing addresses and the total amount each customer has spent with the brand. The company said payment details and passwords were not involved. Customers of its Australian, UK and US stores are affected. ABC News reports that Canadian customers' data was not accessed. WGAC has not published a number of affected customers, and it says it does not yet know whether the data was copied or downloaded.
What Happened
Based on the company's statement as reported by ABC News, the timeline is short:
- 30 October: An unauthorised party began accessing systems at the marketing software provider.
- 31 October: The provider identified the activity.
- 1 November: The provider secured its systems.
- Friday (about a week later): WGAC was told about the breach, according to Griffiths.
- Saturday: WGAC released a statement on its website and emailed customers whose information may have been accessed.
The gap is worth noting. The provider contained the incident on 1 November, but WGAC says it was not told until roughly a week later. The company then contacted customers within about 24 hours of hearing about it. The marketing provider has not been publicly named. Neither it nor WGAC has said how the attacker got in or who was behind it.
"We know this is unwelcome news, so we'll be as clear as we can about what we know and what we don't yet know," Griffiths said.
No group has publicly claimed the attack. No regulator filing, such as a notification to Australia's Office of the Australian Information Commissioner or the UK Information Commissioner's Office, has been published.
What Was Taken
WGAC says the data involved includes:
- First and last names
- Email addresses
- Phone numbers
- Mailing addresses
- Total amount spent with WGAC
The company says payment card details and account passwords were not involved. That fits the provider's role: marketing platforms usually hold contact and segmentation data, not payment data.
Volume: Not disclosed. WGAC has given no record count, and no outside reporting has put a figure on it.
Was it stolen? Not confirmed. Griffiths said the company does not know "whether the information was copied or downloaded." So the confirmed finding is unauthorised access. Whether data was taken is still unknown.
Sensitivity: None of these fields is highly sensitive alone. Together they are useful to fraudsters. A verified name, email, phone number and home address, tied to a known brand relationship and a spend figure, is exactly what convincing phishing and phone scams need. Hong Kong's government InfoSec portal notes that criminals usually try to make money from breached data through identity theft and fraud. Spend data also lets attackers single out the highest-value customers.
Why It Matters
This is a textbook third-party breach. The victim's own systems were not reported as compromised, but its customers' data was exposed because it sat with a vendor. Industry research released in late October shows how common this has become:
- Kroll's 2026 Data Breach Outlook found that 69% of the individuals affected in the incidents it handled between June 2025 and June 2026 were affected through a third-party breach. Breaches at technology providers accounted for 79% of those individuals.
- Mitratech, citing the 2026 Verizon Data Breach Investigations Report, says third parties were involved in 48% of breaches. It also cites IBM's 2026 Cost of a Data Breach Report, which puts the global average breach cost at $4.99 million and the average time to identify and contain a breach at 247 days.
Kroll also found that 41% of leaders named dependence on vendors as one of their top challenges when deciding how to respond to a breach. WGAC's week-long wait between containment and notification shows why. The victim brand's response clock does not start until the vendor tells it.
WGAC's incident follows a run of recent disclosures with a similar shape. Blockchain analytics firm Chainalysis told BleepingComputer in late October that attackers accessed customer names, email addresses, user IDs and role labels, but not credentials. Hackread, citing Reuters, reports that an FBI breach in October came from a third-party-managed Oracle PeopleSoft platform after a contractor failed to apply a security patch. Reuters sources identified the contractor as working for Accenture. There is no evidence linking any of these incidents to the WGAC breach.
The Attack Technique
Unknown. WGAC has not said how the unauthorised party got into the marketing provider's systems, and the provider has not commented publicly. No one has attributed the attack to a threat actor or connected it to any wider campaign.
For context, the common ways into SaaS and vendor platforms are well documented, though none is confirmed here:
- Stolen or weak credentials. CISA's October advisory AA26-281A describes Chinese government-linked actors using password spraying and taking advantage of missing multifactor authentication.
- Unpatched internet-facing software. In the FBI case, Hackread reports that Mandiant documented ShinyHunters exploiting CVE-2026-35273 in PeopleSoft and using URL encoding to get past web application firewall rules. Kaspersky's Securelist has separately analysed Storm-2603 exploiting the ToolShell SharePoint vulnerabilities (CVE-2025-53770 and CVE-2025-53771) with an implant that runs only in memory and writes nothing to disk.
The two-day window from first access to containment suggests the provider detected the activity fairly quickly. How much data was pulled out in that time is the key open question.
What Organizations Should Do
- Map what customer data sits with each vendor. Marketing, CRM and email platforms often hold full contact records plus purchase history. Send them only the fields they need. Spend totals and home addresses may not be required for every campaign.
- Write notification deadlines into vendor contracts. Require notice within a fixed window, such as 24 to 72 hours of detection, not after containment or investigation. WGAC was told about a week after the incident was secured.
- Require MFA and SSO on vendor admin consoles. Enforce multifactor authentication on every account that can view or export customer data, at both your end and the vendor's. Review who still has access.
- Watch for bulk exports and unusual API activity. Where SaaS platforms provide audit logs, collect them and alert on large exports or new API tokens.
- Warn customers about follow-up scams right away. When contact data leaks, tell customers what you will and won't ask for, so they can spot fake emails, texts and calls that use your brand or reference their order history.
- Customers of WGAC: Treat unexpected messages that claim to come from WGAC, especially ones that mention your spending or ask you to "verify" an account or payment, as suspicious. Go to the company's website directly instead of following links.
Sources: Who Gives A Crap confirms customer data exposed in software breach... | How to detect fileless attacks exploiting ToolShell: analyzing the... | Chinese Government-linked Cyber Threat Actors Combine Automated and... | Chainalysis discloses data breach from "offensive agentic techniques" | FBI Removes Accenture Contractor Over ShinyHunters Job Site Data Br... | Third-Party Data Breaches: What You Need to Know | 7 out of 10 Individuals Hit by Data Breaches Via Third Party, Kroll... | InfoSec: Data Breach