The Federal Trade Commission (FTC) accepted a proposed consent
agreement earlier this week that includes payment of $500,000 for
consumer redress from CafePress, an online platform allowing
consumers to purchase customized merchandise from other consumers
or "shopkeepers", arising from CafePress's alleged
failures to prevent, report, investigate, and remedy multiple data
breaches.
The Allegations in the Complaint
The FTC's complaint asserts that the former owner of
CafePress, Residual Pumpkin Entity, LLC, and its current owner,
PlanetArt, LLC, maintained substandard security practices and
failed to adequately protect consumer data, despite deceptively
representing that its websites incorporated adequate safeguards to
keep consumer's confidential information "safe and
secure." Those failures were exploited by a hacker in February
2019, who ultimately accessed more than twenty million unencrypted
email addresses and encrypted passwords, millions of
