Your Eco Toilet Paper Brand Got Hacked. Your Card Is Fine. Your Inbox Might Not Be.

If you buy recycled toilet paper from Who Gives A Crap, this weekend’s email was not a joke about extra-soft bamboo rolls. The company told shoppers in the United States, the United Kingdom, and Australia that some of their personal information was accessed in a security incident at a marketing software company it uses.

The good news, and you should hear it before the anxiety spike: Who Gives A Crap says payment details, order details, and passwords were not involved. Your account with the company was not broken into. The less-good news is that the information that may have been seen is exactly the kind scammers use to write emails that feel personal.

Here’s what leaked, what didn’t, and what to do about it—whether you shop there or you just buy groceries from any company that shares your name with a marketing tool (which is, unfortunately, most of them).

What happened?

Who Gives A Crap is the Australian company known for bamboo and recycled toilet paper, tissues, and paper towels, with a U.S. shop at us.whogivesacrap.org. It donates 50 percent of its profits toward toilets and clean water, and its U.S. site says it has donated more than $14 million so far.

Over the weekend, customers started getting an email from CEO and co-founder Simon Griffiths. Cyber Daily, which saw the message, quoted him writing: “I’m writing to inform you that your personal information was accessed without authorisation in a security incident at one of our marketing software providers.”

The timeline, matching reports from ABC News and Cyber Daily, looks like this:

1. The unauthorized access began on October 30, 2026.
2. It was spotted on October 31.
3. The affected systems were secured on November 1.
4. The vendor told Who Gives A Crap on Friday, November 6.
5. Customer emails went out Saturday, November 7.

The vendor is a U.S.-based marketing software provider. The company has not named it. As of Sunday, November 8, Cyber Daily reported that no group had publicly claimed responsibility for the intrusion.

Griffiths said the company does not yet know “whether the information was copied or downloaded.” There is, the company said, “no evidence of misuse so far.” It also has not said how many customers are involved.

What was exposed—and what wasn’t

According to the company, the information involved was:

• First and last name
• Email address
• Phone number
• Mailing address
• The total amount you’ve spent with Who Gives A Crap

It did not include payment details (so no card numbers), order details (no list of what you bought, or when), or passwords. “Your account with Who Gives A Crap is secure and was not directly accessed,” Griffiths told customers, according to 7NEWS.

Shoppers of the Australian, U.K., and U.S. stores were affected. Canadian customers’ information was not accessed, according to what the provider reported back to the company.

Why a name, address, and spend total are still useful to a scammer

A lot of people hear “no credit cards, no passwords” and close the tab. Please don’t, at least not yet.

Think of this like someone photocopying the outside of your mail, not breaking into your wallet. They may not have your Visa number. They may have enough to sound like they already know you.

If a stranger knows your full name, your home address, your phone number, your email, and roughly how much you’ve spent with a particular brand, they can write a message that feels uncomfortably real. It might claim there’s a problem with your subscription and ask you to “confirm your card” so the next box still ships. It might promise a refund and send you to a page that asks for a bank account. It might be a text that uses your real street name, or a phone call that mentions the brand you actually buy.

7NEWS reported that the company itself flagged this as the main worry: “The main concern is scam or phishing messages that use your real details to look convincing.”

Phishing, in plain English, is a fake message designed to trick you into clicking a link, typing a password, or handing over a card number. The old versions were full of typos and addressed you as “Dear Customer.” The newer ones borrow real details from incidents like this, which is why “but they knew my address” is no longer proof that a message is legitimate.

What you should do now

You do not need to burn your credit cards or freeze every account tonight. You do need to treat unexpected messages with extra suspicion for a while.

1. If you shopped with Who Gives A Crap in the U.S., U.K., or Australia, watch for the company’s own notice. It should read like a straight explanation, not a demand that you “verify” anything in the next 15 minutes. If you’re unsure whether an email is really from them, don’t click the links. Open a new browser tab and go directly to the official U.S. store, or the company’s help center, and look for an announcement there.
2. Be extra wary of follow-up messages. Anyone can write you an email, text, call, or even a letter that uses your real name and address. The company asked customers to stay alert to unexpected emails, texts, calls, and mail, and to verify any communication that claims to be from Who Gives A Crap.
3. Remember what the company says it will not have lost here: your password and your payment details. So a message that asks you to “reset your password because of the breach” or “update the card we can no longer charge” is waving a huge red flag. Go to the official site yourself if you actually need to change something.
4. Don’t give anyone a one-time code, a password, or a card number in reply to a surprise message. Real companies almost never ask for those things out of the blue, and they don’t ask you to pay over the phone with gift cards, payment apps, or a “verification” link.
5. If a message looks official but feels urgent, hang up or close it, then use a phone number or website you already trust—not the one in the message.
6. If you do click something you later regret, or you typed card details into a page you’re unsure about, call the number on the back of your card and tell your bank. You can also report phishing and scams to the Federal Trade Commission at ReportFraud.ftc.gov. If you think someone is actually using your identity, start at IdentityTheft.gov.

Who Gives A Crap says it has disconnected the affected provider from its systems completely and changed access credentials. It also said it will engage with the relevant regulatory authorities as required, and that it will update customers if it learns anything new that affects them or their data.

Griffiths apologized in the notice: “I’m sorry this happened. Our team is doing everything we can to monitor the situation and strengthen our defences against breaches.”

Why it matters to you

Even if you’ve never ordered a single bamboo roll, this is the same plot that keeps showing up: you trusted Brand A, and Brand A handed some of your details to Tool B so it could send you marketing emails. Tool B got breached. You find out about a week later.

Who Gives A Crap’s own privacy policy, last updated in June 2026, explains that it shares personal information with outside companies that handle marketing, email, analytics, and customer service. That is normal for an online shop. It is also why a leak at “one of our marketing software providers” can expose your name and address even when the shop’s own login system stays locked.

The useful habit is simple. When a company you recognize emails you after a breach (or after anything), treat the details they already know as worthless as proof. Your name, your street, even how much you’ve spent—those are now just costume pieces a scammer can wear.

And if you subscribe to household stuff the way a lot of us do, take two minutes this week to notice which stores have your address and phone number sitting in a marketing list. You can’t recall that data from the internet. You can refuse to click the “urgent” follow-up.

Quick checklist

• Watch for unexpected emails, texts, calls, or mail that mention Who Gives A Crap or use your real address.
• Don’t click links in surprise messages. Go to the official site yourself.
• Nobody legitimate needs your password, card number, or a login code because of this notice.
• Payment details and passwords were not part of this incident, according to the company.
• Report suspicious messages to the FTC at ReportFraud.ftc.gov.
• If something already feels wrong with a card or an account, call the number on the back of the card.

Staring at a sketchy email right now and not sure what you’re looking at? Send me a note through the Contact Us page.

If you’d rather hear the short version out loud, I post daily tech shorts on YouTube.

Helpful gear

A few related products worth knowing about. As an Amazon Associate I earn from qualifying purchases.

• YubiKey 5 NFC — A hardware key that adds phishing-resistant login for email and password managers.
• Fellowes Powershred 79Ci — Cross-cut shredder for mail and statements after a data leak.
• Kensington MagPro 15.6in privacy screen — Limits side-angle peeking on a 15.6-inch laptop screen.

Sources

• ABC News: Who Gives A Crap confirms customer data exposed in software breach (Nov. 8, 2026)
• Cyber Daily: Aussie recycled toilet paper brand Who Gives a Crap discloses data breach (Nov. 8, 2026)
• 7NEWS: Who Gives A Crap customers caught up in data breach after third-party provider hacked (Nov. 8, 2026)
• Who Gives A Crap USA store (company background and donation figures)
• Who Gives A Crap USA privacy policy (updated June 2026)