Toilet paper company Who Gives A Crap has confirmed a data breach exposing customers' personal information in the UK, US and Australia, after an unauthorised party accessed systems belonging to one of its third-party marketing software providers in late October.

The incident exposed customers' first and last names, email addresses, phone numbers, mailing addresses and their total historical spending with the company. Customers in Canada were not affected, while payment information, order details and account passwords were not accessed, according to the company.

In a statement published on Saturday 7 November, co-founder and chief executive Simon Griffiths said the company had been informed of the incident by an unnamed US-based software provider. The provider reported that unauthorised access began on 30 October, was identified on 31 October and was secured on 1 November.

The company said it had been notified on Friday 6 November and subsequently contacted affected customers by email. However, it remains unclear whether the attackers copied or downloaded any of the exposed information.

Griffiths said: "Some of our customers' personal information was accessed without authorisation in a security incident at one of our marketing software providers."

Who Gives A Crap said it had disconnected the affected provider from its systems and changed access credentials following the incident. It is continuing to work with the supplier to understand the findings of its investigation and determine whether further action is necessary.

The company said it would engage with relevant regulatory authorities as required and provide customers with further updates if new information emerged. It has not identified the software provider involved in the breach.

The company warned that exposed contact details could be used by criminals to make fraudulent communications appear legitimate, increasing the risk of phishing attacks and other scams targeting customers.

Customers have been advised to exercise caution when receiving unexpected emails, text messages, telephone calls or postal communications claiming to come from the company. Who Gives A Crap said it had found no evidence that the exposed information had been misused.

Griffiths apologised to affected customers, saying: "I'm sorry this happened. Our team is doing everything we can to monitor the situation and strengthen our defences against breaches."

The incident adds to the security risks associated with organisations sharing customer information with external software providers, particularly where third-party systems hold data collected through online retail operations.

---