CafePress.com Suffered Data Breach Affecting 23M Accounts – No Official Disclosure Yet!

  •  
  •  
  •  
  • 5
  •  
  •  
  •  
    5
    Shares

CafePress.com, an American e-commerce platform, turns out to be another victim of a cyber attack. Although the store hasn’t revealed anything officially. The news surfaced online suggesting a hacking attack happened earlier this year. It turns out that the site CafePress.com suffered a data breach impacting 23 million accounts.

CafePress.com Faced Data Breach

According to Troy Hunt and his ‘Have I Been Pwned’ website, the American merchandise site CafePress.com suffered a data breach this year. The service was hacked back in February 2019, where the attackers managed to access 23 million records.

As revealed, the breach affected 23,205,290 accounts exposing the personal details of users. Specifically, it included names, email addresses, SHA-1 hashed passwords, physical addresses, and phone numbers of the users.

Though the incident happened on February 20, 2019, it largely remained undisclosed. Then,  security researcher Jim Scott spotted the data. According to his statement to Forbes,

About two weeks ago I got notified by Troy that CafePress.com data breach was circulating and if I had seen it… With the help of my colleagues, I started to search for the database until I found it.

In the previous month, another website similar to HIBP revealed the incident in a tweet.

However, it got little focus. Hence, the customers had no idea of the breach until HIBP sent email notifications to the users.

Customer’s Passwords Reset After ‘Updating Password Policy

Despite facing the attack, the site did not precisely inform its customers. Rather it simply asked the users to update their passwords, giving a weird justification.

According to the email shared by a Darren Pauli,

This email has no mention of a security issue or a breach. Clearly, the vendors seemed to keep the matter hidden for some undetermined reason. Pauli told The Register,

I went to log into CafePress to see if they had my current street address and it threw that ‘change password’ page. No sign anywhere on the homepage or login of the breach – which Hunt puts as February this year – and no email in my inbox from them to notify me.

Anyhow, users of CafePress.com can check their accounts’ status for pwnage via the HaveIBeenPwned website.

Recently, another e-commerce platform, StockX, also behaved in a similar way. It first reset customers’ passwords, only to confirm later about a breach impacting 6 million records.

Let us know your thoughts in the comments.

The following two tabs change content below.
Avatar

Abeerah Hashim

Abeerah has been a passionate blogger for several years with a particular interest towards science and technology. She is crazy to know everything about the latest tech developments. Knowing and writing about cybersecurity, hacking, and spying has always enchanted her. When she is not writing, what else can be a better pastime than web surfing and staying updated about the tech world! Reach out to me at: [email protected]
Avatar

Abeerah Hashim

Abeerah has been a passionate blogger for several years with a particular interest towards science and technology. She is crazy to know everything about the latest tech developments. Knowing and writing about cybersecurity, hacking, and spying has always enchanted her. When she is not writing, what else can be a better pastime than web surfing and staying updated about the tech world! Reach out to me at: [email protected]

Do NOT follow this link or you will be banned from the site!