A coalition of seven states—including New York, New Jersey and Connecticut—announced a $2 million settlement on Dec. 18 with CafePress Inc. over a data breach that compromised the personal information of 22 million consumers nationwide.

The states said that CafePress—a Kentucky-based online retailer of personalized items and apparel including T-shirts, bags and mugs—failed to take action for several months following the February 2019 breach.