CafePress Breach Exposes 23.2M Customer Accounts Including Password Hashes
What Happened – In February 2019 the custom‑merchandise retailer CafePress suffered a data breach that released 23,205,290 unique records. Exposed data included email addresses, names, phone numbers, physical addresses and password hashes stored as SHA‑1.
Why It Matters for Trust & Control Assurance
- The incident illustrates a control gap in credential storage – weak hashing algorithms violate best‑practice access‑control objectives.
- Continuous control‑assurance programs must capture evidence that password‑handling policies meet strong cryptographic standards and are regularly audited.
- Demonstrable, up‑to‑date credential controls provide a defensible audit trail for frameworks such as NIST CSF 2.0.
Who Is Affected – Retail and e‑commerce platforms that store customer credentials; the 23 million affected consumers.
Recommended Actions
- Conduct an immediate review of password‑storage mechanisms; replace SHA‑1 hashes with a modern algorithm (e.g., bcrypt, Argon2).
- Implement regular credential‑storage audits and document hashing policies as part of your identity‑management controls.
- Notify impacted users, enforce mandatory password resets, and monitor for credential‑theft activity.
Technical Notes – The breach was disclosed via HaveIBeenPwned; the exact attack vector was not publicly detailed, but the use of SHA‑1 hashes indicates insufficient protection of credential data. Source: https://haveibeenpwned.com/api/v3/breach/CafePress