November 2026 Third Party Provider Data Breach
Published 7th November 2026
Statement from Simon
Statement from Simon Griffiths, Co-Founder & CEO, Who Gives A Crap
I'm writing to share that some of our customers' personal information was accessed without authorisation in a security incident at one of our marketing software providers. We know this is unwelcome news, so we'll be as clear as we can about what we know and what we don't yet know.
On 6 November 2026, a US-based software provider informed us that an unauthorised party accessed its systems holding information from our Australian, UK and US stores. The provider has told us this began on 30 October 2026, was identified on 31 October and was secured on 1 November 2026. We don't know whether the information was copied or downloaded.
The information involved was customers' first and last names, email addresses, phone numbers, mailing addresses and the total amount spent with us. It did not include payment details, order details or passwords, and we have no evidence of misuse so far. Customers' Who Gives A Crap accounts were not directly accessed and remain secure.
In Canada, the provider reported that no personal information from our Canadian customers was accessed.
We've disconnected the provider from our systems completely and changed access credentials. We're communicating with the provider on their investigation to determine if there is any further action required. We will be engaging with the relevant regulatory authorities, as required.
We're emailing customers whose information may have been accessed. We recommend that you stay alert to unexpected emails, SMS, calls and mail, and verify any message that claims to be from us before replying. We never ask for payment details by email or SMS/text. We don't contact customers by phone.
I'm sorry this happened. Our team is doing everything we can to monitor the situation and strengthen our defences against breaches. We'll update you if we learn anything new that affects you or your data, and in the meantime thanks for your understanding.
Simon Griffiths
Co-Founder & CEO
FAQs
On 7 November 2026, we emailed customers whose information was identified as involved. If you’ve received our email, it explains what we currently know and recommended precautions.
We have no evidence of misuse so far. We don’t yet know whether the information was copied or downloaded. Our incident response team is monitoring the situation. If there are developments that affect you, we'll let you know. In the meantime, please stay alert to unexpected emails, texts and calls, especially any that use personal details to look convincing.
We were made aware of the incident on 6 November. Our first action was to discontinue integrations with the provider. We have been working to obtain as much information as we could and are communicating 24 hours after our first internal incident review meeting.
We will inform you if there are any further developments with this incidents. We will also update this page as needed.
Who Gives A Crap accounts were not directly accessed in this incident, and passwords were not involved, so you don’t need to take any action in relation to your account.
The personal information involved was your first and last name, email address, phone number, mailing address and the total amount you’ve spent with Who Gives A Crap.
There is no indication that the information accessed included payment details, order details or passwords.
Who Gives A Crap accounts were not directly accessed in this incident, and passwords were not involved, so you don’t need to take any action with your account. We do recommend staying alert to unexpected emails, texts and calls, especially any asking for personal information or payment details.
We recommend staying alert to unexpected emails, texts, calls or post, especially any asking you to click a link or share codes or passwords. Scammers can use real details to look convincing, so it’s worth taking a moment to verify any message that claims to be from us before replying. We will never ask for payment details by email or text.
Please don’t click any links, reply, or share codes, passwords or personal information. We will never ask for payment details by email or text. If you’re unsure whether a message is from us, contact our team directly at wedo@whogivesacrap.org.
We’ve disconnected the provider from our systems completely and changed access credentials. We’re communicating with the provider on their investigation to determine if there is any further action required. We will be engaging with the relevant regulatory authorities, as required.
Yes. Your Who Gives A Crap account and our website are secure and even though the provider has secured their platform, we are not sending them customer information.
No. There will be no operational interruptions and you will continue to receive your regular subscription order. You can also manage your subscription on our site as usual.
You can make a request about the personal information we hold through the Manage My Privacy link in our website footer, or contact our Privacy Officer at privacy@whogivesacrap.org. Our Privacy team can help with the next steps.
The incident involved a third-party provider of marketing software. They used customer information to provide us with information that helped us analyse the effectiveness of our marketing spend. We have disconnected the provider from our systems.