Who Gives a Crap Breach: Is Your Marketing Platform the Weak Link?
Australian eco-brand Who Gives a Crap has told customers in Australia, the US and the UK that their contact details were exposed. The breach did not happen on its systems. It happened at a marketing software supplier.
According to Cyber Daily, the incident at the unnamed US provider started on 30 October and was contained by 1 November, but the supplier only told Who Gives a Crap on 6 November. Names, emails, phone numbers, mailing addresses and total spend were exposed. Payment details, order details and passwords were not. The company says it does not yet know whether the data was copied.
The gap that matters is the notice delay
Here is the pattern we see in Australian small businesses: marketing tools get connected by whoever needed a newsletter last year, and nobody reviews them again. They hold your full customer list, they sit outside your IT team's view, and when they are breached you learn about it a week later from the vendor. Under the Privacy Act you are still accountable for that data. If you sell to customers in Sydney, Brisbane or Melbourne, expect a flood of convincing phishing emails and texts that quote real names and spend totals.
What to do this week
- Map your suppliers. List every tool holding customer contact details: email platform, CRM, loyalty app, survey tool, review widget.
- Cut dead integrations. Remove old connections and unused admin accounts, and turn on MFA for every remaining login.
- Check the contract. Find out how fast each vendor must tell you about an incident. Seven days is too slow.
- Brief your team. Warn staff and customers to expect targeted phishing that uses real personal details.
Frequently Asked Questions
Was Who Gives a Crap hacked directly?
No. The company says the incident happened at an unnamed US marketing software provider that held customer data on its behalf. That provider has since been disconnected from Who Gives a Crap's customer systems.
What customer data was exposed?
Names, email addresses, phone numbers, mailing addresses and total spend were exposed. The company says payment details, order details and passwords were not included, and it does not yet know whether the data was copied.
Is my business still responsible if a supplier is breached?
Under the Privacy Act, you generally remain accountable for personal information your suppliers hold for you. That makes it worth knowing who holds your customer data and what your contract says about breach notification.
What should we check first after a supplier breach like this?
List every tool that stores customer contact details, such as email platforms, CRMs and loyalty apps. For each one, confirm who has admin access, whether integrations are still needed, and how quickly the vendor must tell you about an incident.
Not sure who holds your customer data?
We will map your suppliers, check the risky ones and give you a short fix list.
Related Guide
Cybersecurity for Sydney SMBs
Explore our complete guide to protecting your business from cyber threats.
Read the Full Guide →