Who Gives A Crap Data Breach: How to Protect Your Account, Updated November 8, 2026

Information checked: November 8, 2026, at 02:03 UTC (UTC+00:00).

Who Gives A Crap says an unauthorized party accessed some customer information held by a third-party marketing software provider. The information involved names, contact details and total spending, but not payment details, order details or passwords, according to the company’s statement as reported by ABC News.

The incident affects information from the company’s Australian, UK and US stores. The company says customer accounts were not directly accessed and it has no evidence of misuse so far, but it does not yet know whether the information was copied or downloaded. Customers should independently check unexpected messages and secure their email and shopping accounts.

Destaques

• Names, email addresses, phone numbers, mailing addresses and total spending were among the information involved.
• The company says passwords and payment details were not involved, and customer accounts were not directly accessed.
• Access reportedly began October 30, was identified October 31 and was secured November 1, 2026.
• Visit the retailer’s website directly for updates; avoid links and requests for sensitive information in unexpected messages.

What happened in the Who Gives A Crap data breach?

According to ABC’s reporting on the company’s statement, the incident occurred at an unnamed US-based marketing software provider. Who Gives A Crap said it learned of the breach on November 6 and emailed customers whose information may have been accessed on November 7.

The retailer said it disconnected the provider from its systems and changed access credentials. It is working with the provider on the investigation and said it would update customers if it learns anything new affecting them or their data.

The company has not identified the provider in the reporting reviewed. It also does not know whether information was copied or downloaded. Its statement that there was no evidence of misuse describes what it knew at the time; it does not establish that misuse cannot occur later. The provider reported that Canadian customers’ personal information was not accessed.

How can I check for an official update?

Open a new browser window and type au.whogivesacrap.org yourself. Look for a customer update or use the support options on the site to ask whether your details were involved. Check the date and scope of any notice, since an investigation can change what is known.

If you receive a breach email, compare its claims with information you find independently on the official site. Do not use a phone number, link, attachment or QR code in an unexpected message to verify that same message. A real name, address or reference to your shopping history would not prove that a message is genuine.

Not finding an email is not proof that your information was unaffected: messages can be delayed or filtered, and the public information reviewed does not let each reader independently determine their status. Contact the company through its official site if you need clarification.

What information was involved, and why does it matter?

The company identified first and last names, email addresses, phone numbers, mailing addresses and total spending as the categories involved. It said payment information, order details and passwords were not involved. The distinction between total spending and individual order details matters: the company did not say that a list of products purchased was exposed.

If contact information was copied, someone could potentially use it to make a scam message more convincing, for example by referring to a recipient’s name or claiming there is a delivery or refund issue. That is a possible consequence, not a confirmed outcome of this incident. Be cautious with unexpected requests for passwords, payment information or one-time verification codes, even if the sender appears familiar.

How can I protect my account after the breach?

1. Use a unique password. Although Who Gives A Crap says passwords were not involved, replace any password you reuse across sites. Enter the retailer’s address yourself and use its normal account or password-reset process; use a password manager to create and store a strong, unique password.
2. Secure your email first. Email can be used to reset other accounts. Give it a unique password and turn on multi-factor authentication or a passkey where available. Enable these protections on other important accounts that offer them too.
3. Inspect your account. Sign in through the official site and check your contact details, subscription and orders for changes you do not recognize. Check email recovery information and signed-in devices, and remove unfamiliar access where the service allows it.
4. Pause before responding. Do not click unexpected links or provide verification codes to someone contacting you. Independently visit the service’s website if a message claims that payment or account action is urgent.

The Australian Signals Directorate’s phishing guidance recommends using trusted contact details, avoiding unexpected links and protecting accounts with strong authentication.

What should I do if I clicked a suspicious link or shared details?

If you entered a password, go directly to the affected service and change it immediately. Change it on any other account where you reused it. Review recovery details and sign out unfamiliar devices; if your email may be compromised, check its forwarding rules as well. Follow the Australian Cyber Security Centre’s account recovery guidance if you cannot regain control.

If you shared card or banking details, contact your bank promptly using the number on your card or its official app and follow its advice. Report suspected scams to Scamwatch and cybercrime through ReportCyber. Keep relevant messages and a record of what happened to help with any report.

What should customers watch for next?

Further findings could clarify whether data was copied, whether additional information was involved and whether affected customers need to take further action. Those outcomes remain uncertain. Check for company updates through the official site and stay alert to personalized messages in the meantime.

FAQ

Were Who Gives A Crap passwords exposed?

The company says passwords were not involved and customer accounts were not directly accessed. A unique password remains useful protection against unrelated account attacks.

Do I need to replace my payment card?

The company says payment details were not involved in this incident. If you separately gave card details to a suspicious party or see an unfamiliar transaction, contact your bank promptly for advice.

How do I know if my information was affected?

The company emailed customers whose information may have been accessed. Check your inbox and filtered mail, then contact the retailer through its official Australian website if you are unsure.