CEO Simon Griffiths said in a statement released on Saturday that the company had been informed of the breach 24 hours earlier, on Friday. "Some of our customers' personal information was accessed without authorisation in a security incident at one of our marketing software providers," Mr Griffiths said.
The data accessed included customers' first and last names, email addresses, phone numbers, mailing addresses, and the total amount spent with the company. Mr Griffiths said payment details, order details, and passwords were not involved, and that the company had "no evidence of misuse so far." He added that customers' Who Gives A Crap accounts were not directly accessed and "remain secure."
The company said the access began on 30 October, was identified on 31 October, and was secured on 1 November. According to the company's statement, systems holding information from its Australian, UK, and US stores were breached; the provider reported that no personal information from Canadian customers was accessed.
Who Gives A Crap said it had disconnected the provider from its systems completely and changed access credentials. It did not name the provider. The company said it is communicating with the provider about its investigation and will engage with relevant regulatory authorities as required.
Mr Griffiths apologised in his statement: "I'm sorry this happened...Our team is doing everything we can to monitor the situation and strengthen our defences against breaches."
The company urged customers to stay alert to unexpected emails, text messages, calls, and mail, and to verify any communication claiming to be from Who Gives A Crap. It said it would update customers if it learned anything new that affected them or their data.