Breachesby GlyphCafePress
Disclosed Aug 5, 201923,000,000 affectedSettled
2019 breach of 23M users covered up; FTC order and USD 500,000 redress
Hackers breached CafePress servers in February 2019 and published data on more than 23 million users, including emails, weakly protected passwords, security answers and over 180,000 plaintext Social Security numbers. The FTC said the company concealed the breach and ordered former owner Residual Pumpkin to pay USD 500,000 to compensate small businesses.
What is known
| People affected | 23,000,000 (as reported by the organization) |
|---|---|
| Disclosed | Aug 5, 2019 |
| Discovered | Aug 6, 2019 |
| Happened | Feb 19, 2019 |
| Attack | Hacking |
| Data exposed | NamesCredentials and tokensEmailsPasswordsPhone numbersAddressesSocial Security numbersOther |
| Sector | Retail · US |
| Status | Settled |
| Lawsuit or fine | USD 2M seven-AG agreement led by New York (Dec 2020); FTC orders with USD 500,000 redress (March 2022) (about $2.5M) |
| Check your email | Have I Been Pwned |
Sources
California Attorney General breach notice: CafePressWashington Attorney General breach notice: CafePressNotice letter filed with the Delaware DOJ: CafePressOregon DOJ breach notice: CafePressHave I Been Pwned: CafePressNY AG: USD 2 Million agreement with CafePress after data breachFTC to fine CafePress for covering up 2019 data breachFTC Takes Action Against CafePress for Data Breach Cover UpMaine Attorney General breach notice archive: CafePress
Notices filed
History of this record
empty to https://www.maine.gov/ag/sites/maine.gov.ag/files/docs/Data%20breach%20spreadsheet%2012-6-2018%20through%209-14-2020%20REDACTED.xlsxby backfillSource
confirmed to settledby seedSource
empty to 2500000by seedSource
empty to USD 2M seven-AG agreement led by New York (Dec 2020); FTC orders with USD 500,000 redress (March 2022)by seedSource
tech to retailby seedSource
["names","credentials","emails","passwords","phone","addresses"] to ["names","credentials","emails","passwords","phone","addresses","ssn","other"]by seedSource
hibp to organizationby seedSource
23205290 to 23000000by seedSource
In February 2019, the custom merchandise retailer CafePress suffered a data breach. The exposed data included 23 million unique email addresses with some records also containing names, physical addresses, phone numbers and passwords stored to Hackers breached CafePress servers in February 2019 and published data on more than 23 million users, including emails, weakly protected passwords, security answers and over 180,000 plaintext Social Security numbers. The FTC said the companby seedSource
empty to 2019 breach of 23M users covered up; FTC order and USD 500,000 redressby seedSource
empty to CafePressby backfillSource
other to techby backfillSource
["names","credentials"] to ["names","credentials","emails","passwords","phone","addresses"]by backfillSource
empty to hibpby backfillSource
empty to 23205290by backfillSource
2019-09-04 to 2019-08-05by backfillSource
empty to In February 2019, the custom merchandise retailer CafePress suffered a data breach. The exposed data included 23 million unique email addresses with some records also containing names, physical addresses, phone numbers and passwords stored by backfillSource
[] to ["names","credentials"]by backfillSource
unknown to hackingby backfillSource
2019-09-05 to 2019-09-04by backfillSource
empty to 2019-08-06by backfillSource
First recordedby backfillSource
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.