Personal details of Australian, UK and US customers of charitable toilet paper company Who Gives A Crap (WGAC) have been compromised in a data breach of a US marketing software provider that CEO Simon Griffiths says was quickly identified and shut down.

The breach, which was found on 30 October and shut down on 1 November, occurred when unknown parties accessed the systems of the unnamed software provider that WGAC uses for marketing its recycled toilet paper and other sustainable products to customers in over 36 countries.

Compromised information included customer names, email addresses, phone numbers, mailing addresses and information about total spend with WGAC but did not, Griffiths said in a statement, include payment details, order details, or passwords.

Data about the company’s Canadian customers were not compromised and WGAC accounts were not directly accessed, with Griffiths saying the accounts “remain secure”.

Customer data exposed in marketing breach

WGAC has since disconnected the software provider from its own systems “completely” and changed its access credentials, with authorities notified and customers warned to be on the lookout for phishing and other scams.

The company, which has been flush with cash since the COVID-19 pandemic drove toilet paper scarcity, was founded in 2012 with a core goal of helping the 2 billion people globally who lack access to sanitation. It is aiming to donate $50 million to such charities by 2028.

Australia-based WGAC has since become a responsible investment success story, donating $20.9 million from sales of its recycled paper and sustainable bamboo products to charities like WaterAid, WaterSHED, and Shining Hope for Communities.

WGAC was notified of the breach of what Griffiths described as “a US-based software provider” on 6 November and he posted details the next day with a promise to “be as clear as we can about what we know and what we don’t yet know.”

“We have no evidence of misuse so far,” an apologetic Griffiths added, noting that WGAC has emailed potentially affected customers and is staying in touch with the software provider as its investigation continues.

Klaviyo connection raises further questions

Rather than paying marketers to build its brand, WGAC relies on email – a strategy that lifecycle marketing and CRM director Mike Altman previously said “gives us a more direct connection to our customers [and] allows us to more efficiently communicate with those audiences.”

And while WGAC has not yet named the marketing provider whose breach led to its compromise, it has said that the compromised party “used customer information to provide us with information that helped us analyse the effectiveness of our marketing spend.”

A case study confirms that WGAC has a close relationship with marketing provider Klaviyo, whose tools helped it grow its email list by 640 per cent in three years.

Information Age is not asserting Klaviyo is at the centre of this incident.

Klaviyo integrates with a number of supporting services including Malomo for shipping related customer emails, Unbounce and Justuno for lead capture, and Recharge – used by 20 per cent of WGAC’s customers to manage subscriptions for regular deliveries of its products.

“It’s about telling a more relevant story for customers utilising the data we collect, versus relying on data that’s owned by a third party,” Altman said, adding that “Klaviyo helps us create a more holistic view of the customer so we can understand who they are, what’s important to them, and where they’re at in their journey.”

That type of holistic customer view, however, is catnip for cybercriminals who regularly target marketing service providers because they contain massive amounts of information about customers, their browsing and spending habits, personal preferences, and more.

If the breached party is in fact Klaviyo, WGAC could be just one of a huge number of victims – with BuiltWith says noting that over 752,000 websites, including around 40,000 in Australia, currently link to Klaviyo’s services and over 811,000 others did so in the past.

Klaviyo’s chequered security past

Klaviyo has had its share of security issues in the past, with a 2022 security incident leading to the theft of multiple Klaviyo email lists and the company now maintaining a managed bug bounty program through Bugcrowd.

In August this year, security firm Melurna found a long-running error on Klaviyo’s signup page that it said had led to customers’ email addresses, passwords, phone numbers, and other data being shared with tech firms Facebook, Google, HubSpot, LinkedIn, and others.

And in June, a cybercriminal claimed to have downloaded contact data on 240,174 customers of online trading platform Tradeify after discovering that Klaviyo had embedded a private API key in JavaScript code that was viewable by visitors to its website.