Pierluigi Paganini August 06, 2019

CafePress, the popular T-Shirt and merchandise website, suffered a data breach that exposed the personal details of 23 million of their customers.

CafePress, the popular T-Shirt and merchandise website, disclosed a data breach that exposed the personal details of 23 million of their customers.

The news was publicly reported by the data breach notification service Have I Been Pwned. 

After being aware of a CafePress dump circulating on the underground, Hunt asked the security researcher Jim Scott to help him in finding it.

Finally, the security duo found on a hacker forum the dump containing details for roughly 493,000 accounts.

According to Have I Been Pwned website, CafePress was compromised in February 2019 and hackers accessed personal details of 23,205,290 users.

This exposed data include email addresses, names, passwords, phone numbers, and physical addresses.

Security experts criticized the way the company managed the incident, some of them pointed out that it has attempted to cover up the breach.

James Scott told BleepingComputer that half of the exposed passwords were encoded in base64 SHA1, which is considered a very weak algorithm to protect secret codes.

The records associated with the remaining users included third-party tokens for logins through Facebook and Amazon.

In response to the incident, CafePress forced users to reset their password without admitting the security breach.

Recently another company, the live marketplace for buying and selling limited edition sneakers, watches, handbags, and streetwear StockX, force a password reset before to disclose a data breach.

Of course, this isn’t the best way to manage a data breach, the first thing to do is to report the incident to the authorities and the impacted users.

Pierluigi Paganini

(SecurityAffairs – CafePress, data breach)

[adrotate banner=”5″]

[adrotate banner=”13″]