Third-Party Marketing Vendor Exposes Who Gives A Crap Customer Data
Written by AI from the linked story. Not reviewed by an editor. How this works
Who Gives A Crap's data breach was not caused by a failure in their own systems, but by a security incident at an unnamed third-party marketing software provider — a classic supply chain risk. Customer personal data including names, addresses, phone numbers, and spending history was exposed, demonstrating that sensitive data shared with vendors carries the same risk profile as data held internally. This matters because organisations are only as secure as their weakest third-party link, and customers bear the consequences regardless of where the breach originates. Regulatory authorities are now involved, highlighting the growing legal accountability businesses face for data processed by their supply chain partners.
Tactical Insight
Immediate actions
- Conduct an urgent audit of all third-party vendors who hold or process customer personal data to assess their current security posture.
- Notify affected customers promptly and provide clear, actionable guidance on phishing vigilance and monitoring for suspicious communications.
Long-term improvements
- Establish a formal Third-Party Risk Management (TPRM) programme requiring vendors to demonstrate security certifications (e.g., ISO 27001, SOC 2) before onboarding.
- Apply data minimisation principles so that marketing vendors receive only the minimum personal data fields necessary to perform their function.
- Contractually mandate breach notification timelines, right-to-audit clauses, and security baseline requirements in all vendor agreements.
Detection measures
- Implement continuous monitoring of data flows to third-party platforms to detect anomalous access or exfiltration events early.
- Require third-party vendors to provide audit logs and incident reports on a scheduled basis so that suspicious activity can be identified proactively.