Who Gives A Crap Confirms Customer Data Breach via Vendor

WGAC was notified on 6 November about what Griffiths described as "a US-based software provider" and published details the next day. "We have no evidence of misuse so far," he said. The company has disconnected the provider completely, changed access credentials, notified authorities and emailed potentially affected customers, warning them to watch for phishing and other scams.

Klaviyo link raises questions

WGAC has not named the vendor, saying only that it used customer information to help analyse the effectiveness of the company's marketing spend. The company relies heavily on email rather than paid marketing, and a published case study shows it works closely with Klaviyo, whose tools helped grow its email list by 640% in three years. There is no confirmation that Klaviyo is involved in this incident.

If it were, the scale could be large: BuiltWith data indicates more than 752,000 websites currently link to Klaviyo, including about 40,000 in Australia. Klaviyo has faced earlier security problems, including a 2022 incident in which email lists were stolen.

Marketing platforms are attractive targets because they hold detailed customer data, from spending habits to preferences. For WGAC's customers, the practical risk is targeted phishing using genuine personal details.

Founded in 2012 to help the 2 billion people without access to sanitation, WGAC has donated $20.9 million to charities and aims to reach $50 million by 2028. Its investigation, in contact with the provider, is continuing.