Privacy Unpacked

Confirmed breach

Who Gives A Crap data breach

AUAustralia

Mezhа and Information Age reported a data breach at Who Gives A Crap (Australia) on 9 November 2026, and it has been confirmed.

One of 2 organisations whose data was taken through Klaviyo. The Klaviyo breach →

People affected
Not reportedno count given yet
Reported
9 November 2026News report and 1 more
Who is affected
Australia, United Kingdom, United States

What was exposed 5

  • Email addresses
  • Phone numbers
  • Names
  • Addresses
  • Information about total spend

How it happened

How
Hacking through a breach of a software provider source
Our translation from Ukrainianчерез злам у постачальника програмного
Through
Klaviyo A case study confirms that WGAC has a close relationship with marketing provider Klaviyo source · 2 organisations hit through Klaviyo →
Way in
a US-based software provider accessed the systems of the unnamed software provider that WGAC uses for marketing source

Sources 2

News reports are read by an AI model; every fact taken from an article was checked word for word against it, and anything it could not find was dropped. · Corrections and changes

Questions about the Who Gives A Crap breach

Was Who Gives A Crap hacked?

Mezhа and Information Age reported a data breach at Who Gives A Crap (Australia) on 9 November 2026, and it has been confirmed. How it happened, by the sources: hacking, through Klaviyo.

What data was exposed in the Who Gives A Crap breach?

Email addresses, Phone numbers, Names, Addresses and Information about total spend, by the notices and reports on this page.

How do I know if I was affected?

Organisations normally tell the people whose data was involved, by letter or email, and that notice says what of yours was in it. We cannot look up individual people. If you got a notice, check that it is real, then follow the steps on this page.

Is there a Who Gives A Crap data breach settlement?

No settlement open for claims is on record for Who Gives A Crap as of 15 November 2026. Every open settlement is listed with its deadline.

Is a letter, email or text about the Who Gives A Crap breach real or a scam?

A real notice names the breach, says what data was involved and never asks for a password, a code or a payment. Criminals often send fake notices after a breach is in the news. Do not use links or phone numbers in the message: go to Who Gives A Crap’s own site, or check the letter here.

More breaches in Australia

  1. RMSreportedAUAustralia · 2 November 2026 NamesContact informationBooking information –not reported
  2. Federal Court of AustraliareportedAUAustralia · 22 October 2026 Court filesCourt transcriptsSensitive family court data –not reported
  3. Oz Hair and BeautyAUAustralia · 19 August 2026 Email addressesPhone numbersNames+2 2Maccounts
  4. FinsureAUAustralia · 19 November 2024 Email addressesPhone numbersNames+1 296.1Kaccounts
  5. digiDirectAUAustralia · 25 October 2024 Email addressesPhone numbersDates of birth+2 304.3Kaccounts

Every breach in Australia →

From the data breach tracker: official notices, breach databases and the news, every fact with its source. Open data (CC BY 4.0) · How the tracker works · Official registers · Corrections and changes · Accuracy audit · For journalists · Found a mistake? Tell us and we correct it.