Teespring teespring.com Teespring data breach: what happened and what to do
In April 2020 the custom apparel site Teespring suffered a breach that exposed 8.2 million customer records: email addresses, names, geographic locations and social media IDs. Have I Been Pwned added it in June 2021.
View all 13,115 breaches- Breach date
- Apr 2020
- Affected
- 8,234,193
- Data exposed
- Email addresses, Geographic locations, Names, Social media profiles
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
Teespring is a site where people design and sell custom printed apparel. Have I Been Pwned (HIBP) lists a Teespring breach dated April 2020 with 8,234,193 affected accounts, added to its database in June 2021.
What happened
HIBP says the breach exposed 8.2 million customer records. Reporting on the leak says the data was posted publicly and tied to a third-party service that had access to some of Teespring's data. Reports disagree on exact dates, so the breach date here is HIBP's.
What was exposed
HIBP lists email addresses, names, geographic locations and social media profiles. Press coverage says the records included usernames, phone numbers and home addresses for some accounts. HIBP's entry doesn't list passwords.
No password is a relief, but the rest still gives a scammer plenty. A real name, an email and a location make a phishing message about a Teespring order or payout look credible. The social media IDs let someone link the record to your public profiles.
The company's response
Teespring said a third-party service it had evaluated retained access to some of its data. HIBP marks the breach as verified.
What to do if you were in it
- 1
Expect phishing that mentions this breach
Criminals use leaked names and emails to write convincing messages. Don't click links in unexpected emails or texts, and go to the company's site by typing the address yourself.
- 2
Review your social media privacy
Teespring records included social media IDs. Check who can see your profile details, and tighten settings on accounts linked to your Teespring login.
- 3
Check apps with access to your accounts
Remove third-party apps and services you no longer use from your Teespring and social accounts. Leaked access tokens are how this type of breach tends to start.
- 4
Turn on two-factor authentication
Add an authenticator app or a passkey to your email, banking and shopping accounts. A leaked password alone then isn't enough to get in.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It looks across breach databases and the dark web for your email and phone number and tells you what to do about each hit.
Frequently asked
Was I affected by the Teespring breach?
Search your email address on Have I Been Pwned, or run a free Serus scan, which also checks the dark web for your email and phone.
What was exposed?
Email addresses, names, geographic locations and social media profiles per HIBP. Some press reports add usernames, phone numbers and addresses.
Were passwords leaked?
HIBP doesn't list passwords for this breach. Changing yours is still a cheap precaution if you reuse it elsewhere.
How many people were affected?
HIBP lists 8,234,193 accounts.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
