Who Gives A Crap? Hackers, apparently, after toilet paper maker's customer data exposed

Your personal details, including your address and spending habits, are now exposed to potential misuse.

Toilet paper company Who Gives A Crap experienced a data breach impacting customers in the UK, US, and Australia. The incident occurred through a third-party US-based marketing software provider, which was compromised on October 30. The unauthorized access, discovered by the provider on October 31 and secured by November 1, was not reported to Who Gives A Crap until November 6. The exposed data includes customer names, email addresses, phone numbers, mailing addresses, and total spending, but not payment information, order details, or passwords. The company is uncertain if the data was copied or downloaded and has warned customers about potential phishing scams. Who Gives A Crap has disconnected the vendor and is cooperating with regulatory authorities, including the UK's ICO.

The reliance on third-party marketing software providers creates a significant vulnerability for e-commerce businesses, as demonstrated by the Who Gives A Crap incident. The extended delay between the provider's discovery of the breach and its notification to Who Gives A Crap highlights systemic issues in supply chain security communication and incident response protocols. This breach underscores the necessity for businesses to rigorously vet their vendors' security practices and to establish clear contractual obligations for timely breach notifications.

This event serves as a stark reminder that even companies selling non-digital goods are susceptible to cyber threats, with customer data being a prime target. The potential for misuse of personal information, such as targeted phishing attacks, means that consumers across multiple countries are now at an increased risk. Businesses must proactively implement robust data protection measures and educate their customer base about the evolving threat landscape, especially concerning data obtained through indirect breaches.