Breach Disclosure: CafePress

On August 4, 2019, CafePress was revealed to have been breached in February 2019. Over 23 million user accounts were exposed, with records including email addresses, names, physical addresses, and phone numbers. Additionally, base64 encoded SHA-1 hashed user passwords were exposed.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
Remain alert to potential spear phishing attacks through email and social media

Details

T-shirt and custom merchandise printing company CafePress, was compromised on February 20, 2019. Details of over 23 million accounts have been revealed - including user passwords. These passwords were not stored securely, and many of them were encoded in base64 SHA1, which is a particularly weak and outdated encryption method.

CafePress has (kind of) made a statement regarding the breach - under the guise of updating their password requirements, the site has required all users to change their password. No other statement has been made at this time.