Australian recycled toilet paper brand Who Gives a Crap has started emailing customers to say their personal information was accessed in a security incident at one of its marketing software providers, Cyber Daily reports.
The provider is based in the US and has not been named.
What was exposed
According to the email from chief executive and co-founder Simon Griffiths, quoted by Cyber Daily, the data involved was:
- first and last name
- email address
- phone number
- mailing address
- the total amount the customer has spent with the company.
The company said payment details, order details and passwords were not included. Griffiths said it did not yet know whether the information was copied or downloaded.
Timeline
| Date | Event (as reported) |
|---|---|
| 30 October | Incident occurs at the provider |
| 31 October | Incident detected |
| 1 November | Affected systems secured |
| 6 November | Provider tells Who Gives a Crap |
| 7 November (late) | Customer emails begin |
Cyber Daily says the company’s disclosure page indicates US and UK customers were also affected, while Canadian customers appear not to be.
The provider has been disconnected from the company’s customer systems, and Who Gives a Crap said it would engage with regulators as required. At the time of Cyber Daily’s report, no group had claimed responsibility.
What customers should do
With names, phone numbers and spending history in play, the main risk is convincing phishing. Customers should be wary of messages that reference their orders or ask them to “verify” details, and should go to the company’s website directly rather than clicking links.
