Who Gives A Crap says some customers’ personal information was accessed without authorization in a security incident at one of its marketing software providers.
In a company statement reported by ABC News on November 8, 2026, CEO and co-founder Simon Griffiths said Who Gives A Crap learned of the incident on Friday, November 6, and began emailing potentially affected customers the next day. The unnamed U.S.-based provider told the company that unauthorized access began on October 30, was identified on October 31, and was secured on November 1.
Systems holding information from the Australian, U.K., and U.S. stores were involved. The provider reported that personal information from Canadian customers was not accessed.
What information was involved
According to the company, the information involved included customers’ first and last names, email addresses, phone numbers, mailing addresses, and the total amount spent with Who Gives A Crap. Payment details, order details, and passwords were not involved. Customer accounts were not directly accessed and remain secure, Griffiths said.
Who Gives A Crap said it does not yet know whether the information was copied or downloaded, and that it has no evidence of misuse so far. The main concern it flagged for customers is scam or phishing messages that use real details to look convincing.
Company response
The company said it disconnected the provider from its systems completely, changed access credentials, and is working with the provider on the investigation. It said it will engage with relevant regulators as required and will update customers if it learns anything new that affects them or their data. Who Gives A Crap has not publicly named the marketing software provider.
Customers were urged to stay alert to unexpected emails, texts, calls, and mail, and to verify any communication claiming to be from Who Gives A Crap.
Partner marketing and support tools remain a common path into brand customer lists. BreachNews previously covered the ENGIE partner marketing tool breach and the KDDI third-party software exposure.
