Tens of thousands of (last four digits and expiration dates). Legal and Regulatory Consequences
: The initial intrusion occurred on or before February 19, 2019 . While CafePress patched the vulnerability in March 2019, they did not fully investigate or notify customers until September 2019, after the leak was widely reported in the media. Tens of thousands of (last four digits and expiration dates)
Millions of unique , full names , physical addresses , and phone numbers . Passwords obscured using the outdated SHA-1 hash. Millions of unencrypted security questions and answers . Tens of thousands of (last four digits and expiration dates)