FTC v. CafePress, et al. (Data Security, Data Breach)

In March 2022, the Federal Trade Commission (“FTC”) took action against CafePress, an online merchandise platform, over its failure to adequately secure consumer data, resulting in multiple breaches. The FTC charged that CafePress had stored sensitive information such as Social Security numbers and password reset answers in plain text, retained data longer than necessary, and failed to implement proper security measures to prevent breaches. The company’s security failures were exploited by hackers in February 2019, compromising millions of consumer records, including email addresses, physical addresses, Social Security numbers, and payment details. Despite being notified of the breach, CafePress failed to investigate it promptly and did not inform affected consumers until September 2019, months after the incident was reported publicly.