VULNpocalypse
MediumBreach / campaignMonitoring

Who Gives A Crap says supplier breach exposed customer data

Who Gives A Crap says an unnamed US marketing software supplier was breached, per The Register; customers should watch for phishing.

Published
Exploitation
No confirmation of misuse. The company says it found no evidence of misuse and does not yet know whether the data was copied (per The Register).

What happened

According to The Register, which saw an email the company sent to affected customers over the weekend, Who Gives A Crap says personal information was accessed without authorization after a security incident at an unnamed US-based marketing software provider The Register. This is the company’s account as relayed by one outlet. It has not been independently verified, and the supplier has not been heard from directly in the source.

The Register reports that, according to the customer email, the intruder gained access to the supplier’s systems on October 30. The supplier spotted the intrusion the following day and says it secured its systems by November 1. Who Gives A Crap says it was not told until November 6. The Register notes it is unclear why the supplier waited that long The Register.

The company says it has disconnected the provider from its systems, changed access credentials, and begun warning customers. The Register reports that CEO Simon Griffiths said in a separate public statement that the company is “engaging with the relevant regulatory authorities, as required.” The UK ICO told The Register that Who Gives A Crap Limited has reported an incident and that it is assessing the information provided The Register.

Not confirmed, according to The Register’s reporting:

  • Whether the data was copied or downloaded. The company told customers, “We don’t yet know whether the information was copied or downloaded,” and says it found no evidence of misuse.
  • The identity of the software provider. The company has not named it.
  • How many customers were affected, including in the UK.
  • How the intruder got in: not confirmed in the source.

The Register says the company did not respond to its questions The Register.

Am I affected?

According to The Register, citing Griffiths’ public statement, the incident affected customers of the company’s Australian, UK and US stores. The Register reports that the supplier says no personal information belonging to Canadian shoppers was accessed The Register.

The Register reports that the company’s email lists the exposed information as:

  • names
  • email addresses
  • phone numbers
  • mailing addresses
  • total spending with the company

The company says payment information, order details and passwords were not involved, and that customer accounts were not directly accessed. The company says it is warning affected customers directly The Register.

What to do now

  1. Check whether you received the notification email from Who Gives A Crap. The company says it is warning affected customers directly.
  2. Be wary of unsolicited emails, texts, calls and other communications. The company’s stated main concern, as quoted by The Register, is “scam or phishing messages that use your real details to look convincing.”
  3. Do not rely on contact details in an unexpected message. Not confirmed in the source: any specific official contact channel or any recommendation to reset passwords. The company says passwords were not involved.
  4. Watch for updates from Who Gives A Crap, the supplier and the ICO. The supplier’s name, the number of people affected and whether data was copied are all still unconfirmed.

Sources