FTC to Fine CafePress for Cover up of Massive Data Breach
The U.S. Federal Trade Commission (FTC) wants to slap the former owner of the CafePress custom t-shirt and merchandise site with a $500,000 fine for failing to secure its users’ data and attempting to cover up a significant data breach impacting millions.
As the consumer protection watchdog explained, CafePress’ former owner, Residual Pumpkin Entity, stored its customers’ Social Security numbers and password reset answers in plain text, and their data longer than necessary.
“As a result of its shoddy security practices, CafePress’ network was breached multiple times,” the FTC said today.
“The Commission’s proposed order requires the company to bolster its data security and requires its former owner to pay a half million dollars [PDF consent order here] to compensate small businesses.”
Also Read: Top 10 Reliable IT Companies in Singapore
Per the proposed settlement, Residual Pumpkin and PlanetArt (CAfePress’ new owner) will be required to implement multi-factor authentication, minimize the amount of collected and retained data, encrypt Social Security numbers stored on its servers.
The massive February 2019 data breach
Following a February 2019 breach of CafePress’ servers, unknown attackers accessed and later put up for sale on the dark web a throve of information belonging to 23,205,290 users, including:
- millions of email addresses and passwords with weak encryption;
- millions of unencrypted names, physical addresses, and security questions and answers;
- more than 180,000 unencrypted Social Security numbers;
- and tens of thousands of partial payment card numbers and expiration dates.
CafePress purportedly tried to cover up this massive data breach and did not inform any of the impacted customers until September 2019, one month after BleepingComputer reported the breach.
At the time, CafePress did not respond to BleepingComputer’s queries and did not issue a statement regarding the incident. The only indication that something was wrong was that users were forced to reset their password when logging in (with no mention of the breach).
Failures to report breaches and investigate attacks
CafePress was also aware that it had data security problems even before the 2019 data breach. According to FTC’s complaint, the company discovered that some shopkeepers’ accounts had been hacked through at least January 2018.
Instead of informing them of the incidents, CafePress instead closed their accounts and charged them each a $25 account closure fee.
The company’s network was also hit by several malware infections before the 2019 security breach and failed to investigate the attacks again.
The FTC added that CafePress also allegedly “misled users by using consumer email addresses for marketing despite its promises that such information would only be used to fulfill orders consumers had placed.”