CafePress Data Breach exposes technical details of 23 Million users

CafePress, the popular T-Shirt and merchandise website, suffered a data breach that exposed the personal details of 23 million of their customers.

CafePress, the popular T-Shirt and merchandise website, disclosed a data breach that exposed the personal details of 23 million of their customers.

The news was publicly reported by the data breach notification service Have I Been Pwned. 

I just updated the CafePress breach description on @haveibeenpwned to include passwords. It's a really odd thing: there's a heap of identical base64 encoded "passwords" and then some SHA-1 versions stored in hex then base64 encoded. Weird. https://t.co/OlgiuM5JNv

— Troy Hunt (@troyhunt) August 5, 2019

After being aware of a CafePress dump circulating on the underground, Hunt asked the security researcher Jim Scott to help him in finding it.

Finally, the security duo found on a hacker forum the dump containing details for roughly 493,000 accounts.

According to Have I Been Pwned website, CafePress was compromised in February 2019 and hackers accessed personal details of 23,205,290 users.

New breach: CafePress had 23M unique email addresses breached in February. Some records also contained names, physical addresses and phone numbers. 77% were already in @haveibeenpwned https://t.co/hv1u9SEsMR

— Have I Been Pwned (@haveibeenpwned) August 5, 2019

This exposed data include email addresses, names, passwords, phone numbers, and physical addresses.

Security experts criticized the way the company managed the incident, some of them pointed out that it has attempted to cover up the breach.

https://twitter.com/GossiTheDog/status/1158484244605353984

James Scott told BleepingComputer that half of the exposed passwords were encoded in base64 SHA1, which is considered a very weak algorithm to protect secret codes.

The records associated with the remaining users included third-party tokens for logins through Facebook and Amazon.

In response to the incident, CafePress forced users to reset their password without admitting the security breach.

Recently another company, the live marketplace for buying and selling limited edition sneakers, watches, handbags, and streetwear StockX, force a password reset before to disclose a data breach.

Of course, this isn’t the best way to manage a data breach, the first thing to do is to report the incident to the authorities and the impacted users.

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – CafePress, data breach)

[adrotate banner=”5″]

[adrotate banner=”13″]