What Happened
Who Gives A Crap, the Melbourne-based DTC toilet paper company, disclosed a third-party data breach affecting customers in Australia, the UK and the US. An unauthorised party accessed customer information stored by a US marketing software provider from 30 October through 1 November. The provider detected the breach on 31 October and secured access on 1 November. Who Gives A Crap was notified six days later, on 6 November.
Exposed data included names, email addresses, phone numbers, postal addresses and total customer spending. Payment details, passwords and order specifics were not affected. The company has disconnected the provider and changed access credentials. The exact number of affected customers has not been disclosed.
Why It Matters for Sales Teams
This breach illustrates a risk most sales organisations face but rarely quantify: vendor security. Who Gives A Crap runs on ecommerce, subscriptions and marketing technology across three markets. That means customer data flows through CRM platforms, marketing automation tools, analytics software and fulfilment systems. One compromised vendor can expose the lot.
For sales teams evaluating or using marketing platforms, CRMs or sales enablement tools, the questions are practical:
- What customer data does this vendor store?
- What are their access controls and breach notification SLAs?
- If they get breached, how fast do we know?
- What does our vendor management checklist actually cover?
Who Gives A Crap learned about the breach six days after detection. That gap matters when you are managing customer relationships across multiple markets. In the US, FTC data breach reporting requirements are tightening. In Australia, notification obligations apply when serious harm is likely. For B2B sales teams, a breach affecting your customer data can torch your pipeline faster than a bad quarter.
The Vendor Risk Reality
Who Gives A Crap has grown from a crowdfunded startup to a business with almost 300 staff, approximately $50 million in reported funding and operations across Australia, the UK and the US. That growth required adding SaaS platforms. Marketing automation, customer data platforms, analytics tools: all holding customer information, all potential breach vectors.
Sales teams face the same reality. Your CRM holds customer contacts, deal values and pipeline data. Your sales engagement platform stores email sequences and phone numbers. Your analytics tools track customer behaviour. One vendor breach can expose all of it.
This is the second operational incident for Who Gives A Crap in four months. In July, the company suspended an AI customer service tool after it incorrectly told customers prices would double. Pattern or coincidence, it underscores that operational risk scales with your tech stack.
What Sales Leaders Should Ask
Vendor security is not an IT problem. It is a revenue protection problem. When evaluating sales tools or marketing platforms:
- Request their breach notification policy and SLA
- Confirm what data they store and where
- Check their compliance certifications (SOC 2, ISO 27001)
- Review their access controls and authentication requirements
- Establish a breach response plan before you need it
Comp transparency matters. So does vendor transparency. The question is not whether your vendors will get breached. The question is how fast you will know, and what you will do about it.