Controversies
Controversies tied to this brand in public sources. A listing is not a finding of fault.
Back to profile4 entries
2022
Federal Trade Commission data-security enforcement
The FTC alleged that CafePress failed to maintain reasonable security practices and did not promptly notify customers after learning of the breach. The settlement required a $500,000 payment and additional security and independent-reporting obligations.
2022
FTC fines CafePress over data breach disclosure and security practices
Fine or penalty
The U.S. Federal Trade Commission fined CafePress $500,000 over its handling and nondisclosure of a 2019 data breach. The FTC alleged that CafePress failed to implement reasonable security measures; the order also requires the company to bolster its data security.
Source excerpt
The U.S. Federal Trade Commission has fined online merchandise provider CafePress Inc. $500,000 over a data breach that the company failed to disclose in 2019.
The commission alleges that CafePress failed to implement reasonable security measures to protect sensitive information stored on its network, including plain-text Social Security numbers, inadequately encrypted passwords and answers to password reset questions.
Along with the $500,000 fine, the FTC also requires CafePress to bolster its data security.
2020
CafePress reaches multistate data breach settlement
Settlement
Seven states entered into a $2 million settlement agreement with e-retailer CafePress stemming from a 2019 data breach that exposed information of approximately 22 million consumers. The agreement provides for an immediate $750,000 payment divided among the states, with the balance subject to suspension if CafePress improves its data privacy practices.
Source excerpt
On December 18, seven states have entered into a settlement agreement with e-retailer Cafe-Press for $2 million stemming from a 2019 data breach that exposed information of approximately 22 million consumers.
The breach affected consumers’ personal information, including usernames and passwords, Social Security numbers and/or Taxpayer Identification numbers.
Of the $2 million, $750,000 will be an immediate payment divided among the states: New Jersey, New York, Connecticut, Indiana, Kentucky, Michigan and Oregon.
2019
CafePress customer data breach
A February 2019 data breach exposed 23 million unique email addresses. Some affected records also contained names, addresses, telephone numbers, security-question information, and Social Security numbers. The incident later became the subject of Federal Trade Commission enforcement.