CafePress data breach

Yesterday, I was contacted by someone saying that he'd received an email from CafePress about a data breach. This was the first I had heard of it, and sure enough I found this link on their homepage: https://www.cafepress.com/p/security2019

I sold Smoke Day t-shirts and other barbecuing/grilling t-shirt designs through CafePress from 2002-2018. If they contact you about this data breach it's because you bought one of my designs from them--or you bought someone else's design from them at some point.

If you have further questions, please contact CafePress at the phone number listed on the page linked above.

pretty sure Restaurant Depot got hit, either that or maybe it's just me. I got a couple emails from RD yesterday or the day before. First one said they'd be running the charge for $2200 or so at noon, and then one said they'd made a mistake & it was $3900, both had clickable links to "view my 'invoice'".

Clint, emails like you got almost never have anything to do with the company in question. Internet mail transport is thoroughly unverified, and all attempts to change that are fundamentally breaking it. A project manager at a previous job didn't believe me when I told him how easy it was. In 20 seconds and a Telnet client, he had an email in his inbox that purported to be from gwbush @ whitehouse.gov (do NOT go to whitehouse.com....) and unless you know how to read the mail headers, you'll never have the slightest indication it wasn't the real McCoy.

For anybody listening in, never, EVER, click on a link in an email, especially if it's a message you were not expecting. If you get a bill, statement, etc., always go to that institution's site and go down that rabbit hole. Links in email are ridiculously easy to spoof, hide, obfuscate, etc.

Thanks for the PSA, Chris.

Today from RD:



"To Our Valued Customers,


We understand that on or about September 17, 2019, many of our customers received an email which incorrectly stated that they had a past due invoice and directed the recipient to an invoice payment screen.

This email was NOT sent by Restaurant Depot or Jetro Cash & Carry. If possible, delete it without opening or clicking any links. Most importantly, don’t provide any financial information in response to the email. At this time, we are not aware of any evidence or information to suggest that our customers’ financial information has been compromised.

If you did attempt to pay the invoice, speak to your financial institution and attempt to cancel any charges. The invoice payment screen was not operated by Restaurant Depot or Jetro Cash & Carry.

We are working to determine what led to this email being sent and hope to update you as soon as we have more information.

If you have concerns about your account with Restaurant Depot or Jetro Cash & Carry, you can contact us through our online form located here.

We apologize for the inconvenience, and we look forward to continuing to serve you.

Sincerely,

Restaurant Depot and Jetro Cash & Carry








Copyright © 2019 RD Corporate Offices, All rights reserved.
You're receiving this email because you opted in at our website

Our mailing address is:
RD Corporate Offices
18-30 132nd Street
College Point, New York 11356

Add us to your address book


Want to change how you receive these emails?
You can update your preferences or unsubscribe from this list"

I got an email from CafePress today about the breach. I only remember ordering from them once, several years ago, and if they took PayPal, I'm sure that's what I used.
I wouldn't think any of my personal info would be compromised, do you?

A couple of people, including my wife, report that they are unsuccessful in logging in to CafePress to change their account password, as recommended on the data breach page.

I called CafePress. They say that accounts are maintained for seven years. If your email address is unrecognized during sign-in, it means your account is closed. That doesn't mean that your info wasn't breached, but it's likely that your CC information on-file was probably expired.

Using PayPal adds a layer of protection because your actual CC number never goes to the merchant.