Who Gives A Crap exposes customer data via third-party provider

Tier D · Background noise – Good to know

Who’s exposed: Shoppers in the UK, US and Australia whose customer data was accessed

Tier D because: Does not hit tech teams

Reach

Attack

Damage

Fix

Exploited in the wild · Secrets exposed

The Brief

Who Gives A Crap says an intruder accessed customer information through a third-party software provider.
The breach affects shoppers in the UK, the US and Australia.
The company is cleaning up after the incident, according to The Register.

Why it matters

Developers who rely on third-party software providers for customer data should review what those vendors can access, since a vendor compromise can expose data from their clients.

The checklist behind the tier

Checklist · 2 of 10 yes

No	Hits tech teams	Judgment: a toilet paper retailer's own customer data breach, not developer or IT software.
No	Core infrastructure	Judgment: a single retailer's customer data breach, not core infrastructure software.
No	Popular tool	Judgment: no widely used framework, tool, platform or package is named as affected.
Yes	Exploited in the wild	The Register: an intruder accessed customer information through a third-party software provider.
No	Public exploit	The Register: no published exploit code or proof-of-concept is mentioned.
No	Remote, no login	The Register: the source does not describe the access method or whether credentials were needed.
No	Full takeover	The Register: only customer information access is reported, not code execution or admin rights.
Yes	Secrets exposed	The Register: intruder accessed customer information, a breach affecting shoppers in UK, US and Australia.
No	Supply chain	The Register: a third-party provider was the access route, but no malicious code shipping is reported.
No	No fix yet	The Register: the source does not mention whether a patch or fix exists.

Source

Who Gives A Crap? Hackers, apparently, after toilet paper maker's customer data exposed ↗ www.theregister.com - Articles · 1h ago

First seen 1h ago · 1 source · Full story page · How tiers are decided