[BreachExchange] 23M CafePress customer records hacked and shared online

[Destry Winant]

https://siliconangle.com/2019/08/05/23m-cafepress-customer-records-hacked-shared-online/

The details of 23 million users of online merchandise provider
CafePress Inc. have been stolen and shared online in a hack that
neither CafePress nor its owner Snapfish Inc. have publicly disclosed
as of Monday.

The hack is believed to have occurred in February and only came to
light after a database of the customer records was provided to Troy
Hunt, the owner of the Have I Been Pwned breach database site, by
cybersecurity researcher Jim Scott.

The database contains 23,205,290 CafePress customer records, including
email addresses, names, phone numbers and physical addresses. About
half the records also had encrypted passwords attached, with most of
them hashed using an older form of encryption known as “base64 SHA1,”
according to Forbes, that’s easily broken in 2019.

CafePress has not commented publicly on the hack, but it would appear
to be fully aware of it. Customers have been forced to reset their
passwords under the guise of a new password policy.

Tech journalist Darren Pauli told The Register that “I went to log
into CafePress to see if they had my current street address and it
threw that ‘change password’ page. No sign anywhere on the homepage or
login of the breach – which Hunt puts as February this year – and no
email in my inbox from them to notify me.”

Exactly how long CafePress has known of the hack remains unclear, but
as with recent hacks, it’s likely to gain the attention of the
European Union under its General Data Protection Regulation. As was
the case with sneaker site StockX, which also failed to come clean
right away on its hack, the regulation not only includes fines for
companies not taking proper care to prevent hacking but also requires
disclosure within 72 hours of its discovery.

The only possible solace for CafePress customers affected is that some
of the data are not new. Some 77% of the email addresses in the
CafePress hacked and shared database have been disclosed previously in
other hacks published by Have I Been Pwned.

CafePress users should change their passwords as soon as possible to
be on the safe side.