2019 — CafePress: Feb 2019 (discovered Jul–Aug 2019), 23.2M records
Data compromised
Emails, names, addresses, phones, passwords
Technical writeup
Feb 2019 (discovered Jul–Aug 2019). CafePress suffered a breach exposing 23.2M customer accounts. Exposed data included emails, names, physical addresses, phone numbers, and passwords (many stored as weak base64-encoded SHA-1 hashes). Company concealed the breach until August 2019 when it forced a password reset without disclosure; formal notification came in October. Class action lawsuit filed.
Root cause
Unauthorized access; weak password storage.