Who Gives A Crap confirms customer data exposed in third party software breach

Customers of Australian toilet paper company Who Gives A Crap (WGAC) have been told their personal information may have been accessed in a third-party cyber security incident.

Customers whose information may have been accessed received emails about the breach on Saturday.

In a statement released by WGAC on Saturday, Chief Executive Simon Griffiths said they had been informed of the breach 24 hours earlier, on Friday.

"Some of our customers' personal information was accessed without authorisation in a security incident at one of our marketing software providers" said Mr Griffiths.

According to the statement, systems holding information from its Australian, UK and US stores have been breached.

The direct-to-consumer brand said the access began on 30 October, was identified on 31 October and was secured on 1 November.

Extent of breach unknown

"We know this is unwelcome news, so we'll be as clear as we can about what we know and what we don't yet know," Mr Griffiths said.

He added the company did not know "whether the information was copied or downloaded".

The data included customers' first and last names, email addresses, phone numbers, mailing addresses and the total amount spent with the company.

Payment details, order details and passwords were not involved, Mr Griffiths said, and the company had "no evidence of misuse so far".

He said customers' Who Gives A Crap accounts were not directly accessed and "remain secure".

The ABC has contacted WGAC for comment.

The company urged customers to stay alert to unexpected emails, text messages, calls and mail, and to verify any communication claiming to be from WGAC.

The provider reported that no personal information from Canadian customers was accessed.

Company response

WGAC said it had disconnected the provider from its systems completely and changed access credentials.

It did not specify what the provider in question was.

WGAC said it is communicating with the provider about its investigation to determine whether further action is needed, and will engage with the relevant regulatory authorities as required.

Mr Griffiths apologised in his statement.

"I'm sorry this happened...Our team is doing everything we can to monitor the situation and strengthen our defences against breaches."

The company said it would update customers if it learned anything new that affected them or their data.