![\"Close-up](\"https:\/\/pagesofwisdom.com\/wp-content\/uploads\/2026\/11\/who-gives-a-crap-laptop-email.jpg\")
What happened?<\/h2>\n\n\n\n
Who Gives A Crap is the Australian company known for bamboo and recycled toilet paper, tissues, and paper towels, with a U.S. shop at us.whogivesacrap.org<\/a>. It donates 50 percent of its profits toward toilets and clean water, and its U.S. site says it has donated more than $14 million so far.<\/p>\n\n\n\n Over the weekend, customers started getting an email from CEO and co-founder Simon Griffiths. Cyber Daily, which saw the message, quoted him writing: \u201cI’m writing to inform you that your personal information was accessed without authorisation in a security incident at one of our marketing software providers.\u201d<\/p>\n\n\n\n The timeline, matching reports from ABC News and Cyber Daily, looks like this:<\/p>\n\n\n\n The vendor is a U.S.-based marketing software provider. The company has not named it. As of Sunday, November 8, Cyber Daily reported that no group had publicly claimed responsibility for the intrusion.<\/p>\n\n\n\n Griffiths said the company does not yet know \u201cwhether the information was copied or downloaded.\u201d There is, the company said, \u201cno evidence of misuse so far.\u201d It also has not said how many customers are involved.<\/p>\n\n\n\n According to the company, the information involved was:<\/p>\n\n\n\n It did not<\/strong> include payment details (so no card numbers), order details (no list of what you bought, or when), or passwords. \u201cYour account with Who Gives A Crap is secure and was not directly accessed,\u201d Griffiths told customers, according to 7NEWS.<\/p>\n\n\n\n Shoppers of the Australian, U.K., and U.S. stores were affected. Canadian customers’ information was not accessed, according to what the provider reported back to the company.<\/p>\n\n\n\n A lot of people hear \u201cno credit cards, no passwords\u201d and close the tab. Please don’t, at least not yet.<\/p>\n\n\n\n Think of this like someone photocopying the outside of your mail, not breaking into your wallet. They may not have your Visa number. They may have enough to sound like they already know you.<\/p>\n\n\n\n If a stranger knows your full name, your home address, your phone number, your email, and roughly how much you’ve spent with a particular brand, they can write a message that feels uncomfortably real. It might claim there’s a problem with your subscription and ask you to \u201cconfirm your card\u201d so the next box still ships. It might promise a refund and send you to a page that asks for a bank account. It might be a text that uses your real street name, or a phone call that mentions the brand you actually buy.<\/p>\n\n\n\n 7NEWS reported that the company itself flagged this as the main worry: \u201cThe main concern is scam or phishing messages that use your real details to look convincing.\u201d<\/p>\n\n\n\n Phishing, in plain English, is a fake message designed to trick you into clicking a link, typing a password, or handing over a card number. The old versions were full of typos and addressed you as \u201cDear Customer.\u201d The newer ones borrow real details from incidents like this, which is why \u201cbut they knew my address\u201d is no longer proof that a message is legitimate.<\/p>\n\n\n\n You do not need to burn your credit cards or freeze every account tonight. You do need to treat unexpected messages with extra suspicion for a while.<\/p>\n\n\n\n Who Gives A Crap says it has disconnected the affected provider from its systems completely and changed access credentials. It also said it will engage with the relevant regulatory authorities as required, and that it will update customers if it learns anything new that affects them or their data.<\/p>\n\n\n\n Griffiths apologized in the notice: \u201cI’m sorry this happened. Our team is doing everything we can to monitor the situation and strengthen our defences against breaches.\u201d<\/p>\n\n\n\n Even if you’ve never ordered a single bamboo roll, this is the same plot that keeps showing up: you trusted Brand A, and Brand A handed some of your details to Tool B so it could send you marketing emails. Tool B got breached. You find out about a week later.<\/p>\n\n\n\n Who Gives A Crap’s own privacy policy, last updated in June 2026, explains that it shares personal information with outside companies that handle marketing, email, analytics, and customer service. That is normal for an online shop. It is also why a leak at \u201cone of our marketing software providers\u201d can expose your name and address even when the shop’s own login system stays locked.<\/p>\n\n\n\n The useful habit is simple. When a company you recognize emails you after a breach (or after anything), treat the details they already know as worthless as proof. Your name, your street, even how much you’ve spent\u2014those are now just costume pieces a scammer can wear.<\/p>\n\n\n\n And if you subscribe to household stuff the way a lot of us do, take two minutes this week to notice which stores have your address and phone number sitting in a marketing list. You can’t recall that data from the internet. You can refuse to click the \u201curgent\u201d follow-up.<\/p>\n\n\n\n Staring at a sketchy email right now and not sure what you’re looking at? Send me a note through the Contact Us page<\/a>.<\/p>\n\n\n\n If you’d rather hear the short version out loud, I post daily tech shorts on YouTube<\/a>.<\/p>\n\n\n\n A few related products worth knowing about. As an Amazon Associate I earn from qualifying purchases.<\/p>\n\n\n\n A Who Gives A Crap vendor may have exposed US shoppers’ names, addresses, and spend totals. What leaked, and how to dodge the phishing that often follows.<\/p>\n","protected":false},"author":1,"featured_media":728,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[73],"tags":[123,121,188,170,191,172,268,271,168,269,184,270],"class_list":["post-727","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tech","tag-cybersecurity","tag-data-breach","tag-email-scam","tag-hack","tag-online-safety","tag-online-security","tag-online-shopping","tag-personal-data","tag-phishing","tag-privacy","tag-scams","tag-who-gives-a-crap"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n
What was exposed\u2014and what wasn’t<\/h2>\n\n\n\n
\n
![\"A](\"https:\/\/pagesofwisdom.com\/wp-content\/uploads\/2026\/11\/who-gives-a-crap-envelope-mail.jpg\")
Why a name, address, and spend total are still useful to a scammer<\/h2>\n\n\n\n
![\"A](\"https:\/\/pagesofwisdom.com\/wp-content\/uploads\/2026\/11\/who-gives-a-crap-email-phone.jpg\")
What you should do now<\/h2>\n\n\n\n
\n
Why it matters to you<\/h2>\n\n\n\n
Quick checklist<\/h2>\n\n\n\n
\n
Helpful gear<\/h2>\n\n\n\n
\n\n
Sources<\/h2>\n\n\n\n
\n