CafePress Custom Merchandise Marketplace Breach (2019): 23 Million Customer Records Including Passwords & Home Address Exposed

About CafePress

CafePress is a custom merchandise and print-on-demand marketplace where independent sellers — called shopkeepers — design and sell personalized products including apparel, mugs, and accessories. The platform connects individual designers with buyers and takes a commission on sales. CafePress was acquired by Snapfish parent company PlanetArt in 2020, having previously operated under Residual Pumpkin Entity LLC.

Why They Hold Your Data

Print-on-demand marketplaces collect buyer and seller identity, addresses, payment-adjacent data, order history, storefront activity, and custom-product records across creator commerce workflows.

Recent Developments

CafePress continues to operate under PlanetArt's ownership following a corporate restructure. The platform operates in a crowded custom merchandise market alongside competitors including Redbubble and Printful. The FTC enforcement action and required security improvements represent the most significant organizational consequence of the breach period.

Data Points Exposed

Breach Impact

In February 2019 an attacker exploited multiple security vulnerabilities to access CafePress systems, stealing data for approximately 23 million accounts including email addresses, names, physical addresses, security question answers, weakly encrypted passwords, tens of thousands of partial payment card numbers, and more than 180,000 Social Security numbers stored in plaintext. The company was notified of the breach in March 2019 by a security researcher but concealed the incident for six months, requiring password resets while characterizing the change as a routine policy update. A foreign government separately warned CafePress in April 2019 that customer data was for sale on dark web markets. CafePress did not notify affected customers until September 2019 — one month after the breach was publicly reported by media outlets. The FTC filed a complaint against both the former and current owners in 2022, citing careless security practices, plaintext storage of Social Security numbers, cover-up conduct, and misrepresentation of data security practices. The settlement required Residual Pumpkin to pay $500,000 in redress to affected individuals and mandated that both companies implement comprehensive security programs including multi-factor authentication. Refunds were distributed to SSN-affected individuals beginning in September 2024.

Exploitation & Downstream Threats

• Credential stuffing against reused passwords across other platforms | • SIM swap attacks where phone numbers are present | • Targeted phishing campaigns using exposed email addresses | • Doxxing risk from physical address exposure

What You Should Do

1. Treat the home address as exposed: review mail and package handling and physical-security routines, and brief household staff to verify unusual requests.
2. Reset any reused passwords and enable MFA on email first, then financial accounts.
3. Guard against SIM-swap and vishing: add a carrier port-out PIN and verify any 'support' calls independently.
4. Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.

How ObscureIQ Can Help

1. Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
2. Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
3. ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).