FTC Delivers $370,000 in Refunds to Consumers Affected by CafePress Data Breach

In a recent development, the Federal Trade Commission (“FTC”) is sending out more than $370,000 in refunds to consumers impacted by the significant data security failures of CafePress. This payment stems from a settlement reached in March 2022, which followed allegations that the online merchandise platform mishandled sensitive consumer data, ultimately putting users at risk for fraud and identity theft. The case revolves around CafePress’s failure to implement basic security measures to protect personal information. The company stored critical data such as Social Security numbers and password reset answers in clear, readable text, leaving this information vulnerable to hackers. Additionally, CafePress retained this sensitive data longer than necessary, further increasing the risk of exposure. Despite several breaches over time, the company failed to promptly notify affected users, leaving many consumers unaware of the risks they faced. As a result of these security lapses, CafePress’s network was compromised multiple times, allowing unauthorized access to a wide range of sensitive personal data, including Social Security numbers. The breaches were not only a violation of consumer trust but also a failure on the company’s part to adhere to basic cybersecurity standards that could have prevented the attacks or at least mitigated their impact.