Who Gives A Crap? Hackers, apparently, after toilet paper maker's customer data exposed

UK shoppers caught up in third-party security mess, and nobody knows whether the data was flushed away

Toilet paper purveyor Who Gives A Crap has found itself in a bit of a mess after an intruder accessed customer information through a third-party software provider, leaving the company scrambling to clean up a breach affecting shoppers in the UK, US, and Australia.

In an email sent to affected customers over the weekend, seen by The Register, the loo roll seller warns that personal information was accessed without authorization after a security incident at an unnamed US-based marketing software provider.

The email explains that the intruder gained access to the supplier's systems on October 30. The provider spotted the intrusion the following day and says it secured its systems by November 1, although Who Gives A Crap wasn't told until November 6. It's unclear why the supplier sat on the bad news for another five days before passing it on.

REG AD

The exposed information includes customers' names, email addresses, phone numbers, mailing addresses, and total spending with the company. In other words, someone may now know not only where you live, but just how much of your hard-earned cash you've flushed down the crapper.

REG AD

Payment information, order details, and passwords were not involved, and customers' accounts were not directly accessed. That's something of a relief, although whether the intruder actually made off with the data remains a pressing question.

"We don't yet know whether the information was copied or downloaded," the company told customers, adding that it had found no evidence of misuse.

In a separate public statement, Who Gives A Crap co-founder and CEO Simon Griffiths confirmed that the incident affected customers across the company's Australian, UK, and US stores. Canadian customers, meanwhile, appear to have escaped this particular toilet emergency, with the supplier reporting that no personal information belonging to shoppers in the country was accessed.

Who Gives A Crap says it has since disconnected the provider from its systems, changed access credentials, and begun warning affected customers to watch out for suspicious emails, texts, calls, and other unsolicited communications.

"The main concern is scam or phishing messages that use your real details to look convincing," the company warned in its customer email.

While Who Gives A Crap has been busy cleaning up, the supplier at the center of this particular stink remains a mystery. The company hasn't identified the software provider or disclosed how many customers were affected, including those in the UK, and didn’t respond to our questions.

Griffiths said the company is "engaging with the relevant regulatory authorities, as required." In the UK, the ICO told The Register: "We can confirm Who Gives A Crap Limited has reported an incident and we are assessing the information provided." 

Who Gives A Crap has plenty of toilet paper to hand, although cleaning up this particular situation might require more than a few rolls. ®