Threat Intelligence Brief
Automated AI summary of third-party reporting
Source: abc.net.au
Threat Risk: Medium
Victim: Who Gives A Crap customers
Incident: Unauthorized access to customer PII via a third-party marketing software provider.
Impact: Exposure of names, emails, phone numbers, and spending history for customers in the US, UK, and Australia.
Attacker: Unidentified threat actors
Analysis: This incident highlights the persistent risk of supply chain attacks through third-party marketing tools. While core payment systems remained secure, the theft of contact details and spending habits creates a significant vector for targeted phishing campaigns. The rapid containment suggests the vulnerability was patched quickly, but the PII is likely already in attacker hands.
Recommendations: Review and audit third-party software permissions and data access levels.; Implement strict data minimization policies when sharing PII with marketing providers.; Educate users on identifying targeted phishing attempts following a PII breach.
Source: ABC News
AI disclosure: this summary was generated automatically by AI from the linked article and was not reviewed by a person. It may contain errors; check the original source before relying on it.
View Original Source
Latest Developments
Update — 2026-11-07 18:35 UTC
Hackers compromised a third-party software provider, granting access to customer information managed by Who Gives A Crap. Customer names, contact details, and spending history were accessed, while payment data and account passwords remained uncompromised. Unauthorized actors compromised an external software service employed by Australian company Who Gives A Crap. The breach allowed attackers to view customer names, contact details, and transaction histories, though payment details and login credentials remained untouched. The company has engaged cybersecurity experts and alerted regulators to address the operational exposure.
Corroborating source: vespernews.com
Update — 2026-11-07 19:19 UTC
An unauthorized party accessed customer personal information through a third-party marketing software vendor. Names, email addresses, phone numbers, postal addresses, and total spending amounts may have been viewed. A security incident at an external marketing software vendor led to unauthorized access to customer data for Who Gives A Crap. The breach exposed details such as names, email addresses, phone numbers, postal addresses, and spending totals, though financial information and passwords remained untouched. The company detected and secured the vulnerability within days, severing ties with the affected provider.
Corroborating source: tech-insider.org
Update — 2026-11-08 03:18 UTC
A third-party software provider suffered an unauthorized access incident that exposed customer personal information. Customer names, contact details, and purchase amounts were exposed, increasing the risk of targeted phishing attacks. A third-party marketing software provider used by the toilet paper company experienced an unauthorized intrusion affecting store customer data. While passwords and financial details remained secure, exposed information included names, contact details, and purchase totals. The company disconnected the compromised vendor, alerted impacted users, and advised vigilance against targeted phishing attempts.
Corroborating source: 7news.com.au
Update — 2026-11-08 04:39 UTC
Customer data was accessed without authorization via a US-based marketing software provider. Names, email addresses, phone numbers, mailing addresses, and purchase totals were accessed. A US-based marketing software provider utilized by Who Gives A Crap experienced unauthorized access that compromised personal customer information. The incident began on October 30 and was halted by November 1 after the vendor was disconnected and credentials were changed. While passwords and payment data remained secure, exposed details include names, contact info, and total spend amounts.
Corroborating source: nacionale.com