CafePress's Previous Owner Fined $500,000 for 'Shoddy' Security, Covering up Data Breach (zdnet.com) 24
ZDNet describes CafePress as "a U.S. platform offering print-on-demand products" like custom t-shirts, hats, and mugs.
"CafePress's past owner has been fined $500,000 over a litany of security failures and data breaches," ZDNet reported this week: CafePress became the subject of a US Federal Trade Commission (FTC) investigation surrounding how it handled security — and how the firm allegedly "failed to secure consumers' sensitive personal data and covered up a major breach." On March 15, the US regulator said that Residual Pumpkin is required to pay $500,000 in damages. According to the FTC's complaint (PDF), issued against the platform's former owner Residual Pumpkin Entity, LLC, and its current owner PlanetArt, LLC, there was a lack of "reasonable security measures" to prevent data breaches.
In addition, the FTC claims that CafePress kept user data for longer than necessary, stored personally identifiable information including Social Security numbers and password reset answers in cleartext, and did not patch against known system vulnerabilities. "As a result of its shoddy security practices, CafePress' network was breached multiple times," the FTC says. CafePress experienced a major security incident in 2019. An attacker infiltrated the platform in February 2019 and was able to access data belonging to millions of users. This included email addresses, poorly-encrypted passwords, names, home addresses, security questions and answers, some partial card payment records, phone numbers, and at least 180,000 unencrypted Social Security numbers....
According to the FTC, CafePress was notified a month after the breach and did patch the security flaw — but did not investigate the breach properly "for several months." Customers were also not told. Instead, CafePress implemented a forced password reset as part of its "policy" and only informed users in September 2019, once the data breach had been publicly reported. In a separate case in 2018, CafePress allegedly was made aware of shops being compromised. These accounts were closed — and the shopkeepers, the victims, were then charged $25 account closure fees.
The FTC also claims that the company "misled" users by using consumer email addresses for marketing, despite promises to the contrary.
"CafePress's past owner has been fined $500,000 over a litany of security failures and data breaches," ZDNet reported this week: CafePress became the subject of a US Federal Trade Commission (FTC) investigation surrounding how it handled security — and how the firm allegedly "failed to secure consumers' sensitive personal data and covered up a major breach." On March 15, the US regulator said that Residual Pumpkin is required to pay $500,000 in damages. According to the FTC's complaint (PDF), issued against the platform's former owner Residual Pumpkin Entity, LLC, and its current owner PlanetArt, LLC, there was a lack of "reasonable security measures" to prevent data breaches.
In addition, the FTC claims that CafePress kept user data for longer than necessary, stored personally identifiable information including Social Security numbers and password reset answers in cleartext, and did not patch against known system vulnerabilities. "As a result of its shoddy security practices, CafePress' network was breached multiple times," the FTC says. CafePress experienced a major security incident in 2019. An attacker infiltrated the platform in February 2019 and was able to access data belonging to millions of users. This included email addresses, poorly-encrypted passwords, names, home addresses, security questions and answers, some partial card payment records, phone numbers, and at least 180,000 unencrypted Social Security numbers....
According to the FTC, CafePress was notified a month after the breach and did patch the security flaw — but did not investigate the breach properly "for several months." Customers were also not told. Instead, CafePress implemented a forced password reset as part of its "policy" and only informed users in September 2019, once the data breach had been publicly reported. In a separate case in 2018, CafePress allegedly was made aware of shops being compromised. These accounts were closed — and the shopkeepers, the victims, were then charged $25 account closure fees.
The FTC also claims that the company "misled" users by using consumer email addresses for marketing, despite promises to the contrary.
Uhh? (Score:2)
Re: (Score:2)
The same reason Facebook needs your name and phone number.
Re: (Score:2)
Re: (Score:2)
If you were a vendor or contractor of them you'd provide your SS number or TIN.
Re: (Score:2)
Re: (Score:1)
They have 2.6 million online shops for others to sell things, the people running those have to supply TIN or SSN. The wonder is that it was only 180K numbers leaked.
Re: (Score:2)
Re:Uhh? (Score:4, Insightful)
CafePress features on demand merch production, and they handle the payment process as well.
I believe that they send you your portion of the sale, so that has to be reported to the IRS for income purposes.
It may only need to be reported over a certain threshold, but they still may need to report it.
Re: (Score:2)
1099-K, most likely. Which does require SSN or EIN.
Re: (Score:2)
CafePress features on demand merch production, and they handle the payment process as well.
I believe that they send you your portion of the sale, so that has to be reported to the IRS for income purposes.
It may only need to be reported over a certain threshold, but they still may need to report it.
Exactly. It's the federal government, and to a lesser extent some (most?) state governments, that are the reason we have to hand out SSNs like candy.
Re: (Score:3)
Why does a merchandise printing company need social security numbers?
I would assume that it's not for the customers, it's for the vendors who operate out of the site so they can be issued proper documentation for tax purposes. If you're doing business as a sole proprietorship without an LLC or other type of corporation, your tax ID is your SSN.
Statists gonna State (Score:1)
So that they can report the earnings of the sellers to the IRS.
The likes of Paypal and Venmo now need that too [slashdot.org] — and certain Slashdotters think it a good thing...
Indeed, the only reason we still don't have tracking chips built into the cash (paper banknotes) is the technology lagging behind the Statists' desires...
Taste of their Own Medicine (Score:1)
Re: (Score:2)
Also do members of Congress and their families. See how fast a law gets passed that makes it life without parole for CEOs if you fail to secure SSNs. See how fast business that don't need the number by law purge it from their systems.
Congress won't act until it's personal.
Ok great! (Score:3)
Now can we fine Google, Facebook, Amazon, Microsoft, CloudFlare, Akamai and all the others, not for "failing to secure consumers' sensitive personal data and covering up a major breach", but for actively conning people out of giving it away on a massive scale and being totally secretive and deceptive about it? The latter is much worse than the former, so why aren't they being punished too?
Re: (Score:2)
Now can we fine Google, Facebook, Amazon, Microsoft, CloudFlare, Akamai and all the others, not for "failing to secure consumers' sensitive personal data and covering up a major breach", but for actively conning people out of giving it away on a massive scale and being totally secretive and deceptive about it? The latter is much worse than the former, so why aren't they being punished too?
Better lawyers.
Re: (Score:2)
why aren't they being punished too?
He did not offer governments a share in the data.
Can we do Twitter next? (Score:1)
I'm 99% sure at some point, or even today, they have vulnerabilities where you can find the phone number of pseudo-anonymous users.
Jack needs to have his anus stretched 10 sizes in Alcatraz
CafePress aren't alone (Score:1)
For over twenty years I've been "tagging" the e-mail addresses I give out to companies with the company-name. Then, when I start getting spam — and even scams — at the tagged address, I know exactly, which business sold me (or was broken into).
Among the "biggies" are Dropbox and Nutrisystem... Yeah...
They treat it as a cost of doing business (Score:2)
DBs still open (Score:3)
I get to live the fun (Score:2)
The FTC also claims that the company "misled" users by using consumer email addresses for marketing, despite promises to the contrary.
I am sill seeing this, I ordered a Slackware sweatshirt and made the mistake of not using my throw-away email. Hoping this fine will end the practice.