CafePress

Summary

CafePress, a custom T-shirt and merchandise company, has suffered a breach that compromised approximately 23.2 million accounts. CafePress claims an update to their password policy initiated the mass password reset this week; however, at the time of this writing, the company has not acknowledged the breach. Compromised information includes email addresses, names, phone numbers, and physical addresses, which can be used by threat actors to further propagate illicit social engineering attempts. Approximately 12 million users’ passwords may have also been exposed, according to Troy Hunt, the founder of Have I Been Pwned, a site which allows users to verify if their account information may have been compromised due to a breach. Impacted customers are advised to change passwords, avoid reusing compromised credentials, and monitor accounts for suspicious activity.