CafePress cafepress.com CafePress data breach: what happened and what to do
In February 2019 the custom merchandise retailer CafePress suffered a data breach. Have I Been Pwned counts 23,205,290 accounts, with email addresses and, for some, names, physical addresses, phone numbers and passwords stored as SHA-1 hashes.
View all 13,115 breaches- Breach date
- 20 Feb 2019
- Affected
- 23,205,290
- Data exposed
- Email addresses, Names, Passwords, Phone numbers, Physical addresses
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
CafePress, a custom merchandise retailer, suffered a data breach in February 2019. Have I Been Pwned added the data on 5 August 2019 and counts 23,205,290 accounts, about 23 million unique email addresses.
What was exposed
Every record had an email address. Some also held names, physical addresses, phone numbers and passwords. The passwords were stored as SHA-1 hashes. SHA-1 is a fast, old hashing method, which means weak or common passwords can be recovered from the hashes with little effort.
What that lets criminals do
The password hashes are the urgent part. If your CafePress password was simple, or you used it on other sites, someone can try it against your email, shopping and social accounts. That's called credential stuffing, and it works because so many people reuse passwords.
Names, addresses and phone numbers add a second risk. A scammer who knows what you ordered from, where you live and your phone number can write a convincing text or letter. Expect messages that look like order problems or refund notices.
What to do
Change your CafePress password, and change it anywhere else you used it. Use a unique password for each site and turn on two-factor login where it's offered. If you gave CafePress a phone number, treat unexpected texts about orders with suspicion.
What to do if you were in it
- 1
Change the password, and every reuse of it
Change your CafePress password, then change any other account that used the same or a similar one. A password manager makes unique passwords easy.
- 2
Turn on two-factor login
Add an authenticator app or security key on your email and other important accounts, so a leaked password alone doesn't get anyone in.
- 3
Expect order and refund scams
Some records had names, addresses and phone numbers. Be wary of texts, emails or letters about orders or refunds, and go to the retailer's site yourself.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your details show up in a new leak. It can't delete breach data, but it tells you what to change.
Frequently asked
Was I affected by the CafePress data breach?
Enter your email address on Have I Been Pwned to see whether it was in the data. A free Serus scan also checks breach databases for your email and phone.
What was exposed in the CafePress breach?
Email addresses for all accounts. Some records also had names, physical addresses, phone numbers and passwords stored as SHA-1 hashes.
Should I change my password?
Yes. Change it on CafePress and on any other site where you used it, since SHA-1 hashes of simple passwords are easy to crack.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
