A third party marketing software used by the toilet paper company experienced a cyber incident in late October. ( Supplied: Unsplash )
Who Gives A Crap say an unauthorised party accessed customer data held by a US-based marketing software provider.
Names, contact details and total spend were involved, but not payment details or passwords, the company said in a statement.
Customers in Australia, the UK and the US were affected, while Canadian customers' data was not accessed.
Customers of Australian toilet paper company Who Gives A Crap (WGAC) have been told their personal information may have been accessed in a third-party cyber security incident.
Customers whose information may have been accessed received emails about the breach on Saturday.
Customers were informed of the breach through an email communication on Saturday. ( ABC News )
In a statement released by WGAC on Saturday, Chief Executive Simon Griffiths said they had been informed of the breach 24 hours earlier, on Friday.
"Some of our customers' personal information was accessed without authorisation in a security incident at one of our marketing software providers" said Mr Griffiths.
According to the statement, systems holding information from its Australian, UK and US stores have been breached.
The direct-to-consumer brand said the access began on 30 October, was identified on 31 October and was secured on 1 November.
"We know this is unwelcome news, so we'll be as clear as we can about what we know and what we don't yet know," Mr Griffiths said.
He added the company did not know "whether the information was copied or downloaded".
A statement from Chief Executive Simon Griffiths was posted on the company's website after they had been informed of the cyber incident. ( Supplied: Who Gives a Crap )
The data included customers' first and last names, email addresses, phone numbers, mailing addresses and the total amount spent with the company.
Payment details, order details and passwords were not involved, Mr Griffiths said, and the company had "no evidence of misuse so far".
He said customers' Who Gives A Crap accounts were not directly accessed and "remain secure".
The ABC has contacted WGAC for comment.
The company urged customers to stay alert to unexpected emails, text messages, calls and mail, and to verify any communication claiming to be from WGAC.
The provider reported that no personal information from Canadian customers was accessed.
WGAC said it had disconnected the provider from its systems completely and changed access credentials.
It did not specify what the provider in question was.
WGAC said it is communicating with the provider about its investigation to determine whether further action is needed, and will engage with the relevant regulatory authorities as required.
Mr Griffiths apologised in his statement.
"I'm sorry this happened...Our team is doing everything we can to monitor the situation and strengthen our defences against breaches."
The company said it would update customers if it learned anything new that affected them or their data.
