Who Gives A Crap customers caught up in data breach after third-party provider hacked

Australian toilet paper company Who Gives A Crap has warned customers their personal information was accessed without authorisation following a cyber security incident involving one of its software providers.

The company notified customers by email on Friday, revealing an unauthorised party gained access to systems operated by a US-based marketing software provider that stored information from its online shopfront.

According to the notice, the provider said the unauthorised access began on October 30, was detected on October 31 and secured by November 1.

The company said it does not yet know whether any customer information was copied or downloaded.

Customer details exposed in the breach included first and last names, email addresses, phone numbers, mailing addresses and the total amount spent with Who Gives A Crap.

However, the company stressed payment information, order details and account passwords were not affected.

“Your account with Who Gives A Crap is secure and was not directly accessed,” co-founder and chief executive Simon Griffiths told customers.

“The main concern is scam or phishing messages that use your real details to look convincing.”

The company said there was currently no evidence customer information had been misused but urged customers to remain vigilant for suspicious emails, phone calls, text messages or letters.

In particular, customers have been warned scammers may use genuine personal details or purchasing information to make fraudulent communications appear legitimate.

Who Gives A Crap said it had disconnected the affected provider from its systems and changed access credentials while it works to better understand the extent of the incident.

The company said it would also engage with relevant regulatory authorities as required.

“We’re communicating with the third-party provider to understand the details of their investigation to determine if there is any further action required,” the company said.

Customers concerned about potential identity theft or scams have been directed to contact IDCARE and report fraudulent activity to Scamwatch.

In an apology to customers, Griffiths said the company was continuing to monitor the situation and strengthen its cyber security protections.

“I’m sorry this happened,” he said.

“Our team is doing everything we can to monitor the situation and strengthen our defences against breaches.”