Quick Answer
The Who Gives A Crap data breach exposed customer names, email addresses, phone numbers, mailing addresses, and total spending through a third-party provider. The company says passwords, payment details, order details, and customer accounts were not involved. Watch for targeted phishing messages, avoid unexpected links, and verify any contact through Who Gives A Crap’s official website.
Key Takeaways
- Who Gives A Crap disclosed the third-party provider incident on November 7, 2026.
- Unauthorized access began on October 30 and was secured on November 1, 2026.
- Customer contact details and total spending may have been accessed across US, UK, and Australian stores.
- Payment details, passwords, order details, and direct customer-account access were not involved.
- The main consumer risk is targeted phishing by email, text message, phone call, or physical mail.
What happened in the Who Gives A Crap data breach?
The Who Gives A Crap data breach involved unauthorized access to systems operated by a US-based third-party software provider. Who Gives A Crap said the provider notified the company on November 6, 2026, that information from its Australian, UK, and US stores had been involved. The company published its incident notice on November 7, 2026, after beginning its response and customer-notification process.
The unauthorized access began on October 30, 2026, according to Who Gives A Crap’s November 2026 incident notice. The provider identified the access on October 31 and secured the affected systems on November 1. This timeline matters because the incident occurred at a service provider rather than through direct access to Who Gives A Crap customer accounts.
Who Gives A Crap described the affected company as a marketing provider, while the specific provider was not publicly identified. The unnamed vendor limits what customers can independently assess about the provider’s systems or its wider customer base. The practical response is to treat unexpected retailer-related messages carefully, especially when they mention a previous order, personal address, or approximate purchasing history.
What customer information was exposed?
The Who Gives A Crap data breach may have exposed 5 categories of customer information: first and last names, email addresses, phone numbers, mailing addresses, and total amount spent. Who Gives A Crap said the affected information came from customers in its Australian, UK, and US stores. The combination of contact details and spending information can make fraudulent messages appear more convincing because a scammer may know details associated with a real customer relationship.
| Information category | Was it involved? | Why it matters |
|---|---|---|
| Name | Yes | A scammer can personalize an email, text, phone call, or letter. |
| Email address | Yes | Email addresses can be used for phishing messages that imitate a retailer. |
| Phone number | Yes | Phone numbers can be used for text-message or phone-call scams. |
| Mailing address | Yes | Physical addresses can make fraudulent communications seem more credible. |
| Total amount spent | Yes | Purchase totals could help an attacker craft a plausible customer-service claim. |
| Payment details | No | Who Gives A Crap said payment details were not involved. |
| Passwords and order details | No | Who Gives A Crap said passwords and order details were not involved. |
Who Gives A Crap said customer accounts were not directly accessed. That reduces the immediate risk of account takeover through this incident, but it does not remove the risk of social engineering. A fraudulent message does not need a password or card number to ask a customer to enter those details on a fake website.
The company also said it did not know whether the accessed information was copied or downloaded and had no evidence of misuse when it issued the notice. Customers should interpret that statement carefully. A lack of known misuse is not proof that data was not taken, so monitoring for scams remains the sensible precaution.
Who may be affected by the Who Gives A Crap data breach?
The Who Gives A Crap data breach may affect customers from the company’s US, UK, and Australian stores whose information was held by the third-party provider. Who Gives A Crap said Canadian customer data was not accessed. The company began emailing customers whose information may have been involved, which means an email notice from the retailer may be legitimate, but customers should still verify the sender and avoid entering credentials through an unexpected link.
The breach notice does not state how many customers were affected. That missing figure means customers cannot use the size of the incident to decide whether to take precautions. A customer who received a notification should assume that the listed contact information may be known to an unauthorized party and should be more alert to messages that use that information.
The incident also illustrates why third-party services matter in online retail. A retailer may use outside providers for marketing, communications, analytics, or other operations, and those systems can hold customer information even when the retailer’s own account systems are not directly accessed. Consumers who want a broader explanation of these risks can review common cybersecurity protections and the ways personal information can be misused.
What scams could follow the Who Gives A Crap data breach?
The main risk after the Who Gives A Crap data breach is targeted phishing. Who Gives A Crap specifically warned customers to be cautious of unexpected emails, text messages, phone calls, and physical mail. Contact details and total-spending information can give an attacker enough context to impersonate a retailer, claim that an order has a problem, or offer a refund that requires a customer to provide payment information. The Cybersecurity and Infrastructure Security Agency’s phishing guidance explains how to recognize and report suspicious messages.
Who Gives A Crap said it never asks for payment details by email or SMS and does not contact customers by phone. Any message that asks for a card number, bank information, password, verification code, or urgent payment should be treated as suspicious. The safest approach is to open a new browser window and visit the company’s official website directly rather than using a link or phone number supplied in a message.
Phone-based scams can be particularly persuasive when a caller knows a name, address, or past spending amount. Do not provide a one-time verification code to an unsolicited caller, even if the caller claims to be confirming a refund or delivery. A legitimate organization can provide support through contact details listed on its own official website.
Customers should also be cautious if an email claims that a security incident requires an immediate password reset. Who Gives A Crap said passwords were not involved in this incident, so an unexpected reset request may be an attempt to capture login credentials. The same general caution applies after other retailer incidents, including reports of exposed email addresses through a vendor breach.
What should affected customers do now?
Customers affected by the Who Gives A Crap data breach should focus on scam prevention rather than payment-card replacement. Who Gives A Crap said payment details and passwords were not involved, so the available facts do not support treating this as a confirmed card-data or account-password breach. The practical concern is that an attacker could use the exposed contact information to create convincing fraudulent messages.
- Review the email notice carefully and confirm that the sender matches Who Gives A Crap’s official communications.
- Visit Who Gives A Crap by typing its address into your browser instead of selecting links in unexpected emails or texts.
- Ignore requests for payment information, passwords, or verification codes sent by email, SMS, or phone call.
- Monitor email, text messages, voicemail, and physical mail for communications that create urgency or request personal information.
- Report suspicious messages through the company’s official support channels and delete them after preserving any details needed for a report.
Customers should change a Who Gives A Crap password only if they reuse that password on other websites or if they see signs of suspicious account activity. Reused passwords create a separate risk because a credential exposed elsewhere can be tried against multiple accounts. Use a unique password for each important account and enable multi-factor authentication where the service offers it.
Do not send a screenshot containing account information, payment details, or verification codes to an unverified support address. Stop and contact the company through its official website if a message asks for sensitive information or pressures you to act immediately. A legitimate support process should not require a customer to disclose payment details through an unsolicited channel.
What has Who Gives A Crap done in response?
Who Gives A Crap said it disconnected the third-party marketing provider, changed access credentials, and began notifying customers whose information may have been involved. These actions are designed to end the provider’s access to the retailer’s data environment and reduce the chance that previously valid credentials could be used again.
Who Gives A Crap also said it is investigating the incident. The company did not identify the marketing-software provider in its public notice, and the provider’s name was also not disclosed in reporting on the customer notifications by ABC News. That unresolved detail means customers should rely on the company’s direct notice for updates rather than assuming that messages naming a provider are genuine.
The company’s response does not establish whether any accessed information was copied or downloaded. That uncertainty is important because data exposure can lead to delayed scams even after an affected system has been secured. The most sensible approach is to remain cautious about retailer-related contacts for the foreseeable future without assuming every message from the company is fraudulent.
How can customers protect their accounts after this breach?
Customers can reduce the risk after the Who Gives A Crap data breach by separating legitimate account activity from unexpected communications. Start account sessions only through a saved bookmark or a manually typed address, and review any security notice within the account itself when possible. This approach prevents a phishing link from directing you to a site designed to collect login or payment information.
Customers should also use unique passwords for retail, email, banking, and payment accounts. Email security deserves particular attention because access to an email inbox can allow an attacker to reset passwords for other services. A password manager can help create and store unique credentials without requiring customers to memorize every password.
Browser privacy and security tools can provide another layer of protection, although they cannot identify every fraudulent message. Updated anti-tracking protections, such as the privacy controls available in Firefox, can limit some forms of online tracking. Those tools do not replace careful verification before entering personal or financial information.
Customers who receive a fraudulent call, text, or email should not reply, select links, or call a number included in the message. Preserve the message if you plan to report it, then use independently verified contact information. Stop and contact your financial institution immediately if you already provided card details, banking information, a password, or a verification code to an unverified party.
FAQ
Was payment card information exposed in the Who Gives A Crap data breach?
No, Who Gives A Crap said payment details were not involved in the third-party provider incident. Customers should still watch for phishing messages that attempt to collect payment information after the breach.
Were Who Gives A Crap customer passwords exposed?
No, Who Gives A Crap said passwords were not involved and customer accounts were not directly accessed. Change a password if you reused it on other services or notice suspicious activity in an account.
Did the Who Gives A Crap data breach affect Canadian customers?
No, Who Gives A Crap said Canadian customer data was not accessed. The company said the affected information came from its Australian, UK, and US stores.
What information was exposed in the Who Gives A Crap data breach?
The Who Gives A Crap data breach involved names, email addresses, phone numbers, mailing addresses, and total amount spent. The company said order details, payment details, and passwords were not involved.
Should I trust an email or text about the Who Gives A Crap breach?
No, customers should not trust an unexpected message without verifying it independently. Who Gives A Crap said it never requests payment details by email or SMS and does not contact customers by phone.