[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fOmASeAucwtzB4FRNXaqQWldzUHynJaaHosdTE8_iOQg":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":136},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"b2b35731-7929-48fc-b32d-70dbaca206f0","Who Gives A Crap? Hackers, apparently, after toilet paper maker's customer data exposed","who-gives-a-crap-hackers-apparently-after-toilet-paper-maker-s-customer-data-exp-baa4ae","UK shoppers caught up in third-party security mess, and nobody knows whether the data was flushed away","Toilet paper company Who Gives A Crap experienced a data breach affecting UK, US, and Australian customers due to a security incident at an unnamed US-based marketing software provider. Personal information including names, email addresses, phone numbers, mailing addresses, and spending history was accessed, though payment details and passwords were not compromised. The company is working with regulatory authorities and advising customers to be vigilant against phishing attempts.","Who Gives A Crap customer data exposed via third-party marketing software provider.","https:\u002F\u002Fwww.theregister.com\u002Fsecurity\u002F2026\u002F11\u002F09\u002Fwho-gives-a-crap-hackers-apparently-after-toilet-paper-makers-customer-data-exposed\u002F5308419","https:\u002F\u002Fimage.theregister.com\u002F?imageId=5308423&width=800","2026-11-09T14:30:00+00:00","2026-11-09T15:00:14.42546+00:00",7,[17,20],{"name":18,"type":19},"Who Gives A Crap","vendor",{"name":21,"type":22},"marketing software","product","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":23,"icon":25,"name":26,"slug":27},null,"Breaches","breaches",[29,34,36,41],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":35},{"id":23,"icon":25,"name":26,"slug":27},{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[18,21],{"controls":49,"vendors":135},[50,79,106],{"slug":51,"name":52,"problem":53,"products":54},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[55,63,71],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"slug":80,"name":81,"problem":82,"products":83},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[84,91,99],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":80,"product_name":88,"url":89,"description":90},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":100,"product_name":103,"url":104,"description":105},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"slug":107,"name":108,"problem":109,"products":110},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",[111,119,127],{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"onetrust","OneTrust","\u002Fvendor-logos\u002Fonetrust.png","third-party-management","OneTrust Third-Party Management","https:\u002F\u002Fwww.onetrust.com\u002Fsolutions\u002Fthird-party-management\u002F","Supplier inventory, risk assessments and monitoring across privacy and security.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"bitsight","Bitsight","\u002Fvendor-logos\u002Fbitsight.png","bitsight-tprm","Bitsight Third-Party Risk Management","https:\u002F\u002Fwww.bitsight.com\u002Fproducts\u002Fthird-party-risk-management","Supplier assessments and continuous monitoring based on security ratings.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"securityscorecard","SecurityScorecard","\u002Fvendor-logos\u002Fsecurityscorecard.png","security-ratings","SecurityScorecard Ratings","https:\u002F\u002Fsecurityscorecard.com\u002Fsolutions\u002Fuse-cases\u002Fsecurity-ratings\u002F","Outside-in security ratings and monitoring of suppliers.",[],{"slug":137,"title":138,"body":139,"framework_refs":140,"framework_notes":148},"third-party-marketing-vendor-exposes-who-gives-a-crap-customer-data","Third-Party Marketing Vendor Exposes Who Gives A Crap Customer Data","Who Gives A Crap's data breach was not caused by a failure in their own systems, but by a security incident at an unnamed third-party marketing software provider — a classic supply chain risk. Customer personal data including names, addresses, phone numbers, and spending history was exposed, demonstrating that sensitive data shared with vendors carries the same risk profile as data held internally. This matters because organisations are only as secure as their weakest third-party link, and customers bear the consequences regardless of where the breach originates. Regulatory authorities are now involved, highlighting the growing legal accountability businesses face for data processed by their supply chain partners.",[141,142,143,144,145,146,147],"CIS Control 15: Service Provider Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","GDPR Article 32","NIS2 Article 21(2)(b)","MITRE ATT&CK T1566: Phishing","CIS Control 3: Data Protection",{"GDPR Article 32":149,"NIS2 Article 21(2)(b)":150,"MITRE ATT&CK T1566: Phishing":151,"CIS Control 3: Data Protection":152,"CIS Control 15: Service Provider Management":153,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":154,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":155},"GDPR Article 32 requires both controllers and processors to implement appropriate technical and organisational measures to protect personal data, meaning Who Gives A Crap has an obligation to ensure its marketing vendor met this standard.","NIS2 explicitly requires organisations to manage supply chain security risks, including assessing the security practices of direct suppliers and service providers handling sensitive data.","With names, emails, phone numbers, and spending history now exposed, affected customers face a heightened phishing risk — a threat vector that the company itself flagged in its customer advisory.","Applying data minimisation and classifying what personal data is shared with marketing vendors would have reduced the sensitivity and volume of information exposed in this third-party breach.","This control requires organisations to establish and maintain a programme to evaluate the security practices of third-party service providers — directly addressing the unvetted marketing vendor that caused this breach.","Supplier security agreements under ISO 27001 require that vendors manage their own technical vulnerabilities, and organisations should verify this — a process that may have surfaced weaknesses in the marketing platform before exploitation.","Ensuring third-party vendors have appropriately scoped access to customer data — with strong authentication and least-privilege principles — would have limited the volume of data accessible during the compromise."]