Aussie recycled toilet paper brand Who Gives a Crap discloses data breach

The Australian company behind a line of recycled toilet paper, tissues, and kitchen towels, Who Gives a Crap, has begun contacting customers to inform them of a cyber security incident impacting their personal data.

“I’m writing to inform you that your personal information was accessed without authorisation in a security incident at one of our marketing software providers,” the email, from CEO and co-founder Simon Griffiths and seen by Cyber Daily, says. ​ “We know this is unwelcome news, so we’ll be as clear as we can what we know.”\

According to the company, the incident occurred on October 30 and was detected a day later, with the impacted systems secured by November 1. The unnamed US-based software provider then informed Who Gives a Crap, headquartered in Australia, on November 6, and Who Gives a Crap began sending emails to customers late on November 7.

“We don’t yet know whether the information was copied or downloaded,” Griffiths said. ​ “The personal information involved was your first and last name, email address, phone number, mailing address and the total amount you’ve spent with Who Gives A Crap. ​ “Importantly, it did not include payment details, order details or passwords.”

The impacted provider has now been disconnected from Who Gives a Crap’s customer systems, and the two companies are working together to understand the extent of the breach. The company also said it would be “engaging with the relevant regulatory authorities, as required.”

A further note on its public disclosure page says the incident also compromised US and UK customer data. Data belonging to Canadian customers, however, appears unaffected.

“I'm sorry this happened. Our team is doing everything we can to monitor the situation and strengthen our defences against breaches,” Griffiths said.

“We'll update you if we learn anything new that affects you or your data, and in the meantime, thanks for your understanding.”

As of the time of writing, no threat actor has claimed responsibility for the attack.

David Hollingworth has been writing technology for over 20 years, and has worked for a range of print and online titles in his career. He is enjoying getting to grips with cyber security, especially when it lets him talk Lego.