[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fAtAAVEPfM1UziRSvo4bG54qDoGRRUV7RzQ_cDBBrjEQ":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"4f9e6011-67b2-409f-956a-b623c942eb00","third-party-marketing-vendor-exposes-who-gives-a-crap-customer-data","b2b35731-7929-48fc-b32d-70dbaca206f0","Third-Party Marketing Vendor Exposes Who Gives A Crap Customer Data","Who Gives A Crap's data breach was not caused by a failure in their own systems, but by a security incident at an unnamed third-party marketing software provider — a classic supply chain risk. Customer personal data including names, addresses, phone numbers, and spending history was exposed, demonstrating that sensitive data shared with vendors carries the same risk profile as data held internally. This matters because organisations are only as secure as their weakest third-party link, and customers bear the consequences regardless of where the breach originates. Regulatory authorities are now involved, highlighting the growing legal accountability businesses face for data processed by their supply chain partners.","**Immediate actions:**\n- Conduct an urgent audit of all third-party vendors who hold or process customer personal data to assess their current security posture.\n- Notify affected customers promptly and provide clear, actionable guidance on phishing vigilance and monitoring for suspicious communications.\n\n**Long-term improvements:**\n- Establish a formal Third-Party Risk Management (TPRM) programme requiring vendors to demonstrate security certifications (e.g., ISO 27001, SOC 2) before onboarding.\n- Apply data minimisation principles so that marketing vendors receive only the minimum personal data fields necessary to perform their function.\n- Contractually mandate breach notification timelines, right-to-audit clauses, and security baseline requirements in all vendor agreements.\n\n**Detection measures:**\n- Implement continuous monitoring of data flows to third-party platforms to detect anomalous access or exfiltration events early.\n- Require third-party vendors to provide audit logs and incident reports on a scheduled basis so that suspicious activity can be identified proactively.",[12,13,14,15,16,17,18],"CIS Control 15: Service Provider Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","GDPR Article 32","NIS2 Article 21(2)(b)","MITRE ATT&CK T1566: Phishing","CIS Control 3: Data Protection",{"GDPR Article 32":20,"NIS2 Article 21(2)(b)":21,"MITRE ATT&CK T1566: Phishing":22,"CIS Control 3: Data Protection":23,"CIS Control 15: Service Provider Management":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"GDPR Article 32 requires both controllers and processors to implement appropriate technical and organisational measures to protect personal data, meaning Who Gives A Crap has an obligation to ensure its marketing vendor met this standard.","NIS2 explicitly requires organisations to manage supply chain security risks, including assessing the security practices of direct suppliers and service providers handling sensitive data.","With names, emails, phone numbers, and spending history now exposed, affected customers face a heightened phishing risk — a threat vector that the company itself flagged in its customer advisory.","Applying data minimisation and classifying what personal data is shared with marketing vendors would have reduced the sensitivity and volume of information exposed in this third-party breach.","This control requires organisations to establish and maintain a programme to evaluate the security practices of third-party service providers — directly addressing the unvetted marketing vendor that caused this breach.","Supplier security agreements under ISO 27001 require that vendors manage their own technical vulnerabilities, and organisations should verify this — a process that may have surfaced weaknesses in the marketing platform before exploitation.","Ensuring third-party vendors have appropriately scoped access to customer data — with strong authentication and least-privilege principles — would have limited the volume of data accessible during the compromise.","published","2026-11-09T15:21:22.447779+00:00","2026-11-09T15:21:22.436+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fwww.theregister.com\u002Fsecurity\u002F2026\u002F11\u002F09\u002Fwho-gives-a-crap-hackers-apparently-after-toilet-paper-makers-customer-data-exposed\u002F5308419","who-gives-a-crap-hackers-apparently-after-toilet-paper-maker-s-customer-data-exp-baa4ae","Who Gives A Crap? Hackers, apparently, after toilet paper maker's customer data exposed",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",{"id":42,"name":43,"slug":44,"description":45,"color":46},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[49,53,57],{"slug":50,"name":51,"problem":52},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",{"slug":54,"name":55,"problem":56},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",{"slug":58,"name":59,"problem":60},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached."]