Who Gives A Crap: Data breach at ethical toilet paper company exposes customer information across UK, US and Australia

Ethical toilet paper company Who Gives A Crap exposes customer information following data breach Customers across UK, US and Australia affected Company warns users to be on their guard for scam or phishing attacks Toilet paper firm Who Gives A Crap has told customers it has suffered a major data bre

<![CDATA[ <article> <ul><li><strong>Ethical toilet paper company Who Gives A Crap exposes customer information following data breach</strong></li><li><strong>Customers across UK, US and Australia affected</strong></li><li><strong>Company warns users to be on their guard for scam or phishing attacks</strong></li></ul><p>Toilet paper firm Who Gives A Crap has told customers it has suffered a major data breach which leaked user information across three major markets.</p><p>In an email sent to customers seen by TechRadar Pro, the company apologized for the "unwelcome news" and promised to be "as clear as we can about what we know".</p><p>It noted that customers in its home country of Australia were affected, along with users in the UK and US - although users in its Canadian market were not affected.</p><h2 id="quot-unwelcome-news-quot">"Unwelcome news"</h2><p>"I’m writing to inform you that your personal information was accessed without authorisation in a security incident at one of our marketing software providers," the email told customers.</p><p>User first and last names, email addresses, phone numbers, mailing addresses were all hit in the breach, as was the total amount the user had spent with Who Gives A Crap.</p><p>The company said it did not know whether the stolen information was copied or downloaded, but did say payment details, order details and passwords had not been affected.</p><p>In a seperate <a href="https://uk.whogivesacrap.org/pages/november-2026-incident-notice" target="_blank" rel="nofollow">blog post</a>, Simon Griffiths, Co-Founder &amp; CEO, Who Gives A Crap, said it had been informed by an unnamed "US-based software provider" that an "unauthorized party" had accessed systems holding information from its online store.</p><p>"The provider has said that access began on 30 October 2026, was identified on 31 October 2026 and was secured on 1 November 2026," the company added.</p><p>Who Gives A Crap said it had disconnected the affected provider from its systems, and changed access credentials. It was also communicating with the affected provider to understand the details of their investigation in order to determine if there is any further action required, and said that it would be engaging with the relevant regulatory authorities as required.</p><p>"Your account with Who Gives A Crap is secure and was not directly accessed, so you don’t need to take any action with your account," it told customers, warning them that the main risks now would come from criminals sending out scam or phishing messages using their real details to look convincing. </p><p>"We have no evidence of misuse so far, but please be extra cautious," it added.</p><div style="min-height: 250px;"> <div class="kwizly-quiz kwizly-X1ljAO"></div> </div> <script src="https://kwizly.com/embed/X1ljAO.js" async=""></script><figure class="van-image-figure inline-layout" data-bordeaux-image-check="" ><div class='image-full-width-wrapper'><div class='image-widthsetter' style="max-width:676px;"><p class="vanilla-image-block" style="padding-top:31.51%;"><img id="diM9tpwF2Lz85R8q85CT78" name="tr-g_news" alt="Google logo on a black background next to text reading 'Click to follow TechRadar'" src="https://cdn.mos.cms.futurecdn.net/diM9tpwF2Lz85R8q85CT78-1920-80.jpg" mos="" align="middle" fullscreen="" width="676" height="213" attribution="" endorsement="" class="inline" /></p></div></div></figure> </article> ]]>