Who Gives A Crap customer names, contact details and total spend exposed through a marketing software vendor
Teaser from the source
Australian toilet paper brand Who Gives A Crap told customers on Nov 7 2026 that an unauthorized party accessed customer data held by one of its US-based marketing software providers, which it has not named. The provider says the access began on Oct 30, was identified on Oct 31 and was secured on Nov 1, and it told Who Gives A Crap on Nov 6. Data from the Australian, UK and US stores was involved: first and last names, email addresses, phone numbers, mailing addresses and the total amount each customer has spent. Payment details, order details and passwords were not included, Who Gives A Crap accounts were not directly accessed, and Canadian customers' data was not accessed. The company says it does not yet know whether the data was copied or downloaded, has seen no misuse so far, has disconnected the provider and changed access credentials, and has not said how many customers are affected.
This is the RSS-feed teaser. Read the full article at the original source.
Read at pwn.watchMore on marketing
Other advisories
- Highosv:MAL-2026-18500Malicious code in @goparrot-dashboard/franchise-marketing (npm)
- Highosv:MAL-2026-18505Malicious code in @goparrot-dashboard/marketing (npm)
- Not ratedCVE-2026-111070The Content Pilot – Autoblogging & Affiliate Marketing Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and includi…
- MediumCVE-2026-107765MarketingFire Discussion Board: Cross-Site-Scripting (XSS)
- Not ratedCVE-2026-109386The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including…
- MediumCVE-2026-107765MarketingFire Discussion Board: Cross-Site-Scripting (XSS)
- Not ratedCVE-2026-119089The ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi…
- Not ratedCVE-2026-119163The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via…
Other news entries
- Energy giant ENGIE discloses data breach affecting customersNewsBleepingComputer
- ENGIE discloses breach of French customer data via a partner marketing toolBreachpwn.watch
- Cox Automotive confirms suspicious activity on VinSolutions dealership CRM after Scarlett Group data theft claimBreachpwn.watch
- How the CISO-CMO Alliance Builds Trust Before Crisis StrikesNewsDark Reading
- 123 Reg: "AI-driven cyberattack" exposed customer contact and account data; registrar suspects a China-nexus actorBreachpwn.watch
- Trezor Says 347,000 Users Received Phishing Emails After Brevo HackNewsSecurityWeek
- North Korean Job Fraud Expands Beyond IT Into Healthcare and SalesNewsThe Hacker News
- Mindgard Raises $30 Million to Protect AI SystemsNewsSecurityWeek
Source: https://pwn.watch/i/who-gives-a-crap-marketing-vendor-customer-data-breach-nov-2026