What information was involved
Who Gives A Crap says an unauthorised party accessed some customers’ personal information held by a US-based marketing software provider. Its November 7 statement identifies names, email addresses, phone numbers, mailing addresses and total spending with the retailer.
The company says payment details, order details and passwords were not included. Customer accounts were not directly accessed. It has no evidence of misuse so far, but does not know whether the information was copied or downloaded. Those are separate findings, not a guarantee that the exposed contact information cannot be misused.
Who is being notified, and when it happened
The provider held information from the retailer’s Australian, UK and US stores. Who Gives A Crap says it emailed customers whose information was identified as involved on November 7. The provider reported no access to Canadian customers’ personal information.
According to the company, the access began on October 30, was identified by the provider on October 31 and was secured on November 1. Who Gives A Crap was informed on November 6. These dates describe the incident and notification separately.
What customers can do
Read the company’s notification and verify unexpected messages before responding. Its guidance is to avoid clicking suspicious links or sharing codes, passwords or payment details. The company says it never requests payment details by email or text and does not contact customers by phone. If unsure, use the contact details on its official incident page.
Who Gives A Crap says it disconnected the provider and changed access credentials. It says customers can continue managing their accounts and subscriptions as usual, with no operational interruption. The incident page will carry further updates.
