Breach Disclosure: Teespring

In April, 2020, the popular on-demand t-shirt printing company Teespring, suffered a data breach. The company disclosed information on the breach on December 1st, 2020, where it was explained access was gained to customer data via a third party service called Waydev. The stolen customer data was subsequently distributed via a popular cyber crime forum dedicated to selling databases and leaked data. The breach contained approximately 12.8 million records of customer data including name, address, email address, social network user ID's and contact numbers.

Standing Intelligence Requirements

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Details

The breached database was posted to a popular cybercrime forum by the user ShinyHunters, a prolific and well-known data broker on the forum. Links were provided within the post allowing visitors to download the breached data as an archive file containing two SQL files.

The first SQL file contained more than 8.2 million records of data containing users' email addresses and timestamps of when the email address was previously updated. The second file included account details for more than 4.6 million users consisting of:

• Email address
• Username
• First and last names
• Phone numbers
• Home address
• Facebook and OpenID identifiers

Prior to being made public, the data was being privately distributed and sold via covert communication channels and Telegram channels dedicated to selling breached databases.