Data Breach – CafePress

Just the Facts

Timeline:

20 February 2019 – CafePress is hacked and over 23 million account are compromised.

13 July 2019 – According to this Forbes article, We Leak Info adds the CafePress breach to their database.

5 August 2019 – The author of the Forbes article receives an email from have i been pwned about the CafePress breach.

20 September 2019 – I receive an email from CafePress about the “Data Security Incident”.

My Take

It’s been 7 months since the data was stolen. If it hadn’t been found in the wild by third parties, they still might not know.

It’s been at least 2 months since they found out and they just now got around to telling their customers.

I didn’t have a CafePress account. Just to be sure, I tried to log in:

Whew!

Whew!


I’ve only purchased from them maybe twice in my life and not for years. That means the hackers only got my name, email, phone number, and physical address. That also means that CafePress kept (I hope it really is past tense) purchase and account records in an internet-facing database for a long time.

A non-apology worthy of a politician caught red-handed:

"...sincerely regret any concern it may cause you"

“…sincerely regret any concern it may cause you”


So they’re not sorry. They just regret that I may have concerns. Concerns that may keep me from giving them my money in the future? That’s like saying something awful to someone and then saying “I regret that your feelings are hurt.”

“…And other information.” I learned about physical address from haveibeenpwned.com.

Later in the email is this:

“What We Are Doing

We have been diligently investigating this incident with the assistance of outside experts. We also have contacted and are cooperating with federal law enforcement authorities. In addition, we have taken various steps to further enhance the security of our systems and your information, and the affected database has been moved to a different environment.”

Not much and pretty vague. The part where the customer has to do things is so long it refers to another section:

“What You Can Do

As described in the “Additional Resources” section below, we recommend you remain vigilant and take steps to protect against identity theft or fraud, including monitoring your accounts and free credit reports for signs of suspicious activity.

We also recommend that you visit the CafePress website at www.cafepress.com and log in to any online account you may have, which should prompt you to change your account password, if you have not done so recently.”

They go on to say:

“In general, you should always ensure that you are not using the same password across multiple accounts, and that you are using strong passwords that are not easy to guess.”

There, there [pat on the head]. That’s trivial, deflecting, and condescending. A user account didn’t cause this, CafePress’s incompetent security did. How about I take investment advice from Bernie Madoff?

One more bit and I’ll stop ranting. About this. For a while.

All of the links in the email, including the big 3 credit reporting agencies, go through CafePress’s email list provider.

I know, let's make the incident email look like spear phishing!

I know, let’s make the incident email look like spear phishing!

I mean, why wouldn’t I trust a link with

…krmpkhgftlhjtmbmjrsbzjfgrpjltskzppmktwzhsrfp_vjjjfrrrrkynfhgmmfmmrr.html

as much as I trust one that goes to

https://consumer.ftc.gov?