FTC accuses CafePress of covering up 2019 data breach

Allegations against CafePress

The FTC said in its complaint that CafePress "failed to provide reasonable security for the Personal Information stored on its network."

The FTC said CafePress stored Social Security numbers, as well as security questions and answers, in plain text. In addition, CafePress allegedly stored information indefinitely in its network, failed to implement low-cost protections against "well-known and reasonably foreseeable" vulnerability exploits, and did not require complex passwords from users and vendors. The FTC also criticized CafePress' response, claiming the retailer failed to disclose incidents to relevant parties in a timely manner.

According to the timeline presented in the complaint, CafePress was notified of the breach in March 2019 by an individual claiming the information was being sold in "certain circles." CafePress addressed the vulnerability that month. In April, a foreign government notified CafePress that data had been stolen and was being sold to a large number of credit card thieves.

Soon after, CafePress required users to reset their passwords, with the reason being "only that the company had updated its password policy." The company told "individuals, law enforcement, and regulators" that this reset blocked passwords from further unauthorized use, but this was not the case.

"Until at least November 19, 2019, Residual Pumpkin continued to allow [CafePress] passwords to be reset through Residual Pumpkin's website simply by answering a security question associated with an email address -- information that was stolen in the breach -- without confirming that the individual attempting to change the password controlled that email address," the FTC complaint read. "Thus, until November 2019, anyone with access to the breached data could take over another user's account."

Other CafePress breaches

The FTC complaint also listed other breaches against CafePress. In addition to a history of shopkeeper accounts being hacked, CafePress experienced multiple malware infections in 2018 and 2019 against its servers and employees, including multiple that appeared to result from phishing attacks.

One notable example came in August 2018.

"In August 2018, Residual Pumpkin became aware that an employee had been targeted by multiple phishing attempts," the complaint read. "A scan showed the employee's computer was infected with malware, including a backdoor bot, a 'Trojan' downloader, and a password stealer. Additionally, the employee's email account had been configured for months to forward all incoming email to unknown third-party email addresses."

It continued, "In response to this security incident, Residual Pumpkin replaced the particular computer that was infected, but failed to take reasonable steps to detect, remediate, and prevent similar infections on other devices on its network."

Similar malware was found on the payroll administrator's computer in February 2019. Perhaps resulting from this, the FTC said that in "April, May, and September 2019, an identity thief or thieves used Personal Information belonging to three Residual Pumpkin employees to try to change the employees' payroll direct deposit information. Only after the third incident did Residual Pumpkin at last begin an investigation."

The FTC announcement referenced additional cover-ups, though the complaint only detailed the concealment of the February 2019 breach.

"CafePress employed careless security practices and concealed multiple breaches from consumers," said Samuel Levine, director of the FTC's Bureau of Consumer Protection. "These orders [proposed against CafePress] dial up accountability for lax security practices, requiring redress for small businesses that were harmed, and specific controls, like multi-factor authentication, to better safeguard personal information."

The proposed settlement attached to the complaint requires Residual Pumpkin to pay $500,000 to compensate data breach victims. PlanetArt, meanwhile, will be required to notify consumers whose personal information was accessed via CafePress data breaches and provide information to consumers regarding how they can protect themselves. Both companies will also have to undergo a third-party information security assessment.

Alexander Culafi is a writer, journalist and podcaster based in Boston.