OT Security: What Supermarket Cyberattacks Teach...
Recent cyberattacks targeting supermarket refrigeration systems show how digital compromise can quickly create physical disruption. This article looks at what...
Read More
Who Gives A Crap (WGAC) informed affected customers on 7 November 2026 that some of their personal information had been accessed without authorisation following a security incident at a US-based marketing software provider.
According to the company’s incident notice, the provider said unauthorised access began on 30 October, was identified on 31 October and was secured on 1 November. WGAC was informed of the incident on 6 November. The company said it did not yet know whether the information had been copied or downloaded.
The information involved included customers’ names, email addresses, phone numbers, mailing addresses and the total amount they had spent with WGAC. Payment details, order information and passwords were not involved, and WGAC said customer accounts had not been directly accessed.
The incident is a useful reminder that protecting personal information does not stop at an organisation’s own systems. When customer data is processed by external providers, those relationships form part of the organisation’s wider data protection responsibilities.
Businesses increasingly rely on external platforms for marketing, customer relationship management, payments, analytics, communications, cloud hosting and other services.
Where those suppliers process personal data on an organisation’s behalf, handing the information to a third party does not remove the organisation’s UK GDPR responsibilities.
Controllers must use processors that provide sufficient guarantees that appropriate technical and organisational measures will be in place. This means supplier selection should involve more than assessing whether a platform provides the functionality the business needs.
Organisations should understand what personal data the supplier will receive, why it needs that information, how it will be protected, where it will be processed and what happens if something goes wrong.
These questions should also be revisited throughout the relationship, particularly where the amount or type of data being processed changes.
One particularly useful question raised by incidents involving marketing and analytics platforms is whether every field of customer information being shared is genuinely necessary.
WGAC says the affected provider used customer information to help analyse the effectiveness of its marketing spend. The information involved in the incident included names, email addresses, phone numbers, mailing addresses and total customer spend.
That does not establish that any of those fields were collected or shared unnecessarily. It does, however, illustrate an important question for every organisation: what personal data does this supplier actually need to provide the service?
The UK GDPR data minimisation principle requires personal data to be adequate, relevant and limited to what is necessary for the purpose for which it is processed.
The same principle should be applied when information is passed to external providers. If a supplier only needs particular data to perform a defined function, organisations should consider whether other information can be excluded, pseudonymised or otherwise restricted.
Reducing the amount of information shared will not prevent a supplier breach, but it can reduce the potential impact if one occurs.
UK GDPR requires contracts between controllers and processors to include provisions covering areas such as security, sub-processors, assistance with individuals’ rights, end-of-contract arrangements and audits.
Breach notification is particularly important. Where a processor experiences a personal data breach, it must inform the controller without undue delay once it becomes aware of it. The controller then needs sufficient information to assess the incident and determine whether regulatory or individual notification is required.
This is especially important because the controller may have limited time to make those decisions.
As AJC has previously covered in GDPR’s 72 Hour Rule Explained: Why Businesses Still Get It Wrong, organisations should not wait until every detail of an incident is known before assessing their reporting obligations. Where a personal data breach is likely to result in a risk to individuals’ rights and freedoms, notification to the ICO may be required within 72 hours of the organisation becoming aware of the breach.
Supplier arrangements therefore need to support an effective response in practice. Organisations should understand how quickly they expect to be notified, who will be contacted, what information will be provided and how updates will be shared as the investigation develops.
Clear responsibilities are particularly important where several parties, including sub-processors, may be involved.
A breach does not need to involve passwords or payment card details to create risk for individuals.
In this incident, customers were told that names, addresses, email addresses, phone numbers and spending totals had been accessed. WGAC warned that the principal concern was criminals using genuine personal information to make scams or phishing messages more convincing.
Risk assessments should therefore consider how different pieces of information could be combined and used, rather than assessing each data field in isolation.
A scammer who knows a customer’s name, address, telephone number and relationship with a particular retailer may be able to construct a much more credible message than someone sending a generic phishing email.
Knowledge of how much a customer has spent could provide further opportunities for tailored approaches, such as fake refunds, loyalty rewards or account-related messages.
WGAC specifically warned affected customers that scammers could pose as the company and refer to personal information or spending, including through supposed refunds, prizes, account updates or delivery communications.
This demonstrates why the potential consequences of a breach need to be considered in context.
How an organisation communicates after a data breach is an important part of the response.
Where a breach is likely to result in a high risk to individuals, organisations may also be required to inform affected people without undue delay. Communications should explain clearly what happened, the likely consequences, what the organisation is doing about it and the steps individuals can take to protect themselves.
WGAC’s notification to affected customers provides some useful examples.
The email explained what had happened, identified the information involved, stated what had not been affected, explained the main risk to customers and provided practical advice on dealing with suspicious emails, calls, text messages and post.
It also provided contact details for its customer team and Privacy Officer and explained customers’ right to complain to the ICO.
Importantly, the company also acknowledged what it did not yet know.
Organisations will rarely have every answer when they first communicate a breach. Waiting for complete certainty may leave individuals unable to take protective action. Clear communication should therefore distinguish between confirmed facts, matters still under investigation and practical steps people can take in the meantime.
The WGAC incident provides a useful opportunity for businesses to review their own third-party data protection arrangements.
Organisations should consider:
The objective is not to avoid using third-party services. External providers offer important technology, expertise and efficiency.
The aim is to ensure organisations understand where their personal data goes, why it is there, how it is protected and how they will respond if the organisation holding it experiences an incident.
AJC helps organisations understand and manage their data protection responsibilities across both their own operations and third-party relationships.
Our Data Protection services can include compliance audits and gap analysis, development and management of data inventories and Records of Processing Activities, policies and procedures, privacy notices, Data Protection Impact Assessments, data-sharing and processing agreements, international data transfers and information governance audits.
AJC can also provide Data Protection Officer (DPO) support, helping organisations monitor ongoing compliance, respond to data subject requests, manage regulatory requirements and provide appropriate reporting and guidance to management and boards.
Where an incident occurs, our team can support security and data breach investigations and management, helping organisations assess what has happened, understand their reporting responsibilities and coordinate an appropriate response.
Contact AJC on 020 7101 4861 or email info@ajollyconsulting.co.uk to discuss how we can help strengthen your organisation’s data protection, third-party governance and breach response arrangements.
Sources:
Who Gives A Crap – November 2026 Incident Notice
https://uk.whogivesacrap.org/pages/november-2026-incident-notice
ICO – Responsibilities and Liabilities for Controllers Using a Processor
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/contracts-and-liabilities-between-controllers-and-processors-multi/responsibilities-and-liabilities-for-controllers-using-a-processor/
ICO – Data Minimisation
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/data-minimisation/
ICO – Contracts and Liabilities Between Controllers and Processors
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/contracts/
ICO – Personal Data Breaches: A Guide
https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/
The Register – Who Gives A Crap customer data incident
https://www.theregister.com/security/2026/11/09/who-gives-a-crap-hackers-apparently-after-toilet-paper-makers-customer-data-exposed/5308419
Image accreditation: Vie Studio (March 2020) from Pexels.com. Last accessed on 11 November 2026. Available at: https://www.pexels.com/photo/toilet-paper-rolls-in-packaging-3963082/
Recent cyberattacks targeting supermarket refrigeration systems show how digital compromise can quickly create physical disruption. This article looks at what...
Read More
A fake recruitment process, malicious software and compromised devices were all used in the recent Binance security incident. This article...
Read More
The European Commission’s investigation into Booking.com highlights how fraud can exploit trust within digital platforms. This article looks at the...
Read More