Recycled toilet paper brand Who Gives A Crap has warned customers their personal information has been accessed in a “security incident”.
An “unauthorised party” accessed systems that contained customer first and last names, email addresses, phone numbers, mailing addresses and the total amount they had spent with the company.
The access was gained via one of the brand’s marketing software providers, which hasn’t been named, but is US-based. Who Gives A Crap said the provider “used customer information to provide us with information that helped us analyse the effectiveness of our marketing spend”, but has now been disconnected from its systems.
The provider told Who Gives A Crap it identified an unauthorised party had gained access to the brand’s customer data on October 31, and secured the systems the following day. The toilet paper brand wasn’t informed of the hack until 6 November, it said.
“We don’t know whether the information was copied or downloaded,” Simon Griffiths, co-founder & CEO, Who Gives A Crap said in a statement.
Customers in the UK, Australia and US have been warned by the company to “stay alert” to unexpected emails, SMS, calls and mail, and “verify any message that claims to be from us before replying”.
“We’ve disconnected the provider from our systems completely and changed access credentials,” Griffiths said. “We’re communicating with the provider on their investigation to determine if there is any further action required. We will be engaging with the relevant regulatory authorities, as required.”
There is no indication that the information accessed included payment details, order details or passwords.
In the UK, the incident has been reported to the Information Commissioner’s Office (ICO).
No comments yet