Australian toilet paper company Who Gives A Crap (WGAC) told customers by email on Saturday 7 November 2026 that some of their personal information may have been accessed in a third-party cyber security incident, according to ABC News.

In a statement quoted by the ABC, Chief Executive Simon Griffiths said: "Some of our customers' personal information was accessed without authorisation in a security incident at one of our marketing software providers."

According to the ABC, the company said the provider is US-based, that the access began on 30 October, was identified on 31 October and was secured on 1 November, and that WGAC was told of it on Friday 6 November.

The ABC reports that systems holding information from WGAC's Australian, UK and US stores were involved, while the provider reported that no personal information from Canadian customers was accessed. The data included first and last names, email addresses, phone numbers, mailing addresses and the total amount spent with the company; Mr Griffiths said payment details, order details and passwords were not involved, that the company had "no evidence of misuse so far", that customers' WGAC accounts were not directly accessed, and that it did not know "whether the information was copied or downloaded".

WGAC said it disconnected the provider from its systems and changed access credentials, is working with the provider on its investigation, and will engage with the relevant regulatory authorities as required. It did not name the provider. (source: ABC News)

Updated (10 Nov 2026): Who Gives A Crap's own incident notice, published 7 November 2026, is now the primary source. In it Mr Griffiths confirms the provider's timeline (began 30 October, identified 31 October, secured 1 November; WGAC informed 6 November), the data involved, that Canadian customers' personal information was not accessed, and that WGAC emailed customers whose information was identified as involved on 7 November. (source: Who Gives A Crap)