FTC Sends Refunds to Consumers Harmed by CafePress’s Data Security Failures

The Federal Trade Commission is sending payments totaling more than $370,000 to consumers who were harmed by the data security failures of online merchandise platform CafePress.

The payments stem from a March 2022 settlement that resolved FTC allegations that CafePress failed to implement reasonable security measures to protect the sensitive information stored on its network. In addition to storing Social Security numbers and password reset answers in clear, readable text, CafePress retained the data longer than was necessary. As a result of its shoddy security practices, CafePress’ network was breached multiple times allowing hackers to access sensitive user data including Social Security numbers. The company also failed to adequately inform consumers about these breaches.

The FTC is sending checks and PayPal payments to 20,044 consumers who filed a valid claim before the deadline. Consumers should cash their check within 90 days or redeem their PayPal payment within 30 days.

Consumers who have questions should contact the refund administrator, Rust Consulting, at 1-833-415-2795 or email [email protected]. Consumers can also visit the FTC website to view frequently asked questions about the refund process. The Commission never requires people to pay money or provide account information to get a refund.

The Commission’s interactive dashboards for refund data provide a state-by-state breakdown of refunds in FTC cases. In 2023, FTC actions led to $330 million in refunds to consumers across the country.

The Federal Trade Commission works to promote competition and protect and educate consumers. The FTC will never demand money, make threats, tell you to transfer money, or promise you a prize. Learn more about consumer topics at consumer.ftc.gov, or report fraud, scams, and bad business practices at ReportFraud.ftc.gov. Follow the FTC on social media, read consumer alerts and the business blog, and sign up to get the latest FTC news and alerts.