Supplier Data Breach: What Who Gives A Crap Teaches SMEs
Who Gives A Crap has told UK, US and Australian customers that an intruder got into a marketing software provider holding their details. The shop itself was not breached. If you send customer data to an email, advertising or analytics tool, you are one supplier data breach away from sending the same email to your own customers.
What actually happened
The company’s email to customers, seen by The Register, says the intruder gained access to the supplier’s systems on 30 October. The provider spotted the intrusion the next day and says it secured its systems by 1 November, but Who Gives A Crap was not told until 6 November. The company’s own notice, published on 7 November, says the data involved was first and last names, email addresses, phone numbers, mailing addresses and total spend. It says payment details, order details and passwords were not included, and that customer accounts were not directly accessed.
The company says it does not yet know whether the information was copied or downloaded, and that it has no evidence of misuse so far. It has not named the provider or said how many customers are affected. The notice says the provider used customer information to help analyse the effectiveness of its marketing spend. The ICO told The Register that Who Gives A Crap Limited has reported an incident and that it is assessing the information provided.
Why a supplier data breach matters to a small or mid-sized business
Look at how this happened. Nobody broke into the shop. The customer list sat in a second company’s systems, for a marketing purpose, and that second company was compromised. The supplier says it found the intrusion on 31 October. The shop was told on 6 November.
That is the pattern for most small businesses. Your email platform, CRM, review tool and ad analytics each hold a copy of your customer list. You pay them, so you feel in control. In practice, their security is your exposure, and their delay in telling you is your delay in telling customers.
Two things would have limited the damage. First, sending fewer fields. A tool that helps analyse marketing spend does not obviously need home addresses and phone numbers, and the company’s notice does not explain why it held them. Second, a contract that fixes how quickly the supplier must tell you. Without a number of hours in writing, “promptly” can mean anything.
Responsibility does not move with the data. Under UK GDPR, if you decide why and how customer data is used, you are normally the controller, and you carry the duty to report to the ICO. A supplier acting as your processor must tell you without undue delay. A breach that puts people at risk must normally be reported to the ICO within 72 hours of you becoming aware of it, and our Resources entry on the ICO 72-hour rule explains it. The clock starts when you become aware, which is why the supplier’s silence hurts you.
Finally, the data is useful as bait. The company itself warns that the main concern is scam or phishing messages that use real details to look convincing. A text that knows your name, address and roughly what you spend looks real.
What to do this week
- List every tool that holds your customer data (email, SMS, CRM, analytics, reviews, loyalty) and who owns each account.
- For each one, check which customer fields it receives and ask your IT person to switch off any it does not need, such as phone numbers or full addresses.
- Ask each supplier in writing how quickly they will tell you about an incident, and who your named contact is, and get a number of hours into the contract.
- Check that each tool uses its own login with multi-factor authentication, has no shared passwords, and that old integrations and API keys you no longer use are removed.
- Write a one-page plan for “a supplier tells us they were breached”: who decides, who calls the ICO within 72 hours, who writes to customers, and how you warn them that real details may appear in scam messages.
How Wolfcore helps
Breachy monitors for your exposed data and credentials, so you can see what is already out there and act before a scam message does it for you. It is built for exactly this gap: the data you cannot see because someone else holds it. Learn more at wolfcore.co.uk/breachy, or run the free web vulnerability scan on your own site first.
Ruben Selby Founder and Lead Security Consultant, Wolfcore
Frequently asked questions
It is a breach at a company that holds your customers’ data for you, such as a marketing software provider, rather than a breach of your own systems.
If you are the controller, you carry the duty to report to the ICO. A breach that puts people at risk must normally be reported within 72 hours of you becoming aware of it.
Ask which customer fields they receive, how quickly they will tell you about an incident (in hours, in writing), and who your named contact is.
See also our cyber news roundup for 10 November 2026.