How to tell if your Who Gives A Crap data was hit
Quick answer: Who Gives A Crap, the recycled toilet paper company, says a US-based marketing software provider it used had a security incident that exposed customer names, email addresses, phone numbers, mailing addresses and the total amount each customer has spent. US, UK and Australian customers are affected; Canadian customers are not. Payment details, order details and passwords were not involved. If you were affected, the company says it emailed you on Saturday, Nov 7. (ABC News, Cyber Daily)
What happened
- Oct 30: unauthorized access began at the marketing software provider (the company hasn’t named it).
- Oct 31: the provider spotted it. Nov 1: it was secured.
- Nov 6: the provider told Who Gives A Crap.
- Nov 7: Who Gives A Crap started emailing affected customers.
CEO Simon Griffiths said the company doesn’t yet know whether the data was copied or downloaded, and has “no evidence of misuse so far.” Customer accounts were not directly accessed. (ABC News)
Am I affected?
- Who: customers of the US, UK and Australian Who Gives A Crap stores whose data sat with that marketing provider. Canadian store customers: not affected, per the provider.
- What was exposed: first and last name, email, phone number, mailing address, and your total spend with the company.
- What was not: card numbers, payment details, order details, passwords.
How to check
- Search your inbox (including spam) for an email from Who Gives A Crap about a security incident, sent around Nov 7 (it went out Saturday, Nov 7, Australian time). The company says it emailed the customers whose information was involved.
- No email doesn’t prove you’re clear yet; the company says it will update customers if it learns more.
What to do
- Expect better-targeted phishing. A scammer with your name, address and how much you’ve spent can write a very convincing “problem with your subscription” message. The company urged customers to stay alert to unexpected emails, texts, calls and mail claiming to be from it, and to verify them first. (ABC News)
- Don’t click links in surprise “account” messages. Go to the site directly instead.
- Passwords weren’t part of this, per the company, so there’s no forced reset. Turning on two-factor login where you can is still a good habit.
FAQ
Was my credit card stolen? No. The company says payment details were not involved.
Who is the marketing provider? Not named yet.
How many people are affected? Not disclosed.
I’m in Canada. Am I affected? The provider reported no Canadian customer data was accessed.
Sources
Both report the company’s Nov 7 statement and customer email.
— AltTab Dad