News for hackers. Stuff that matters.

A comment on FTC takes action against CafePress for data breach cover up. Parent comment

Re:FTC takes action against CafePress for data breach cover up by blacksmith_tb on Monday June 27, 2022 @02:32PM (#31898682)
That whole sentence is even more interesting: "the FTC alleges that CafePress failed to implement reasonable security measures to protect sensitive information stored on its network, including plain text Social Security numbers, inadequately encrypted passwords, and answers to password reset questions." Why would CafePress have anyone's SSN? I suppose potentially a merchant selling on it might need to have provided banking details, but that still doesn't seem like it should include a SSN?
[ Parent | on HN ]
Re:FTC takes action against CafePress for data breach cover up by mcculley on Monday June 27, 2022 @02:38PM (#31898774)
An individual can sell custom/branded merchandise on CafePress. If CafePress is sending more than $600 per year to an individual, they have to issue a 1099, which has to have a TIN, which is going to be an SSN for most individuals.
[ Parent | on HN ]
Re:FTC takes action against CafePress for data breach cover up by kayodelycaon on Monday June 27, 2022 @02:38PM (#31898771)
Sole proprietors use their SSN for tax purposes. May also apply to single-member LLCs.
[ Parent | on HN ]
Re:FTC takes action against CafePress for data breach cover up by lsaferite on Monday June 27, 2022 @03:04PM (#31899212)
Can't Sole Proprietors obtain an EIN as well though? No way I'm using my SSN for stuff like that. I always used an LLC with an EIN.
[ Parent | on HN ]
Re:FTC takes action against CafePress for data breach cover up by xeromal on Monday June 27, 2022 @04:18PM (#31900221)
They can. I assume DBAs (Doing business as) folks are the ones that use their SSN. Just real small-time shops.
[ Parent | on HN ]
Re:FTC takes action against CafePress for data breach cover up by lfowles on Tuesday June 28, 2022 @01:02PM (#31910249)
I think the W9 form says to use SSN in case of a disregarded entity (such as a single member LLC).
[ Parent | on HN ]
Re:FTC takes action against CafePress for data breach cover up by lsaferite on Thursday June 30, 2022 @12:00PM (#31934442)
> You must show your individual name and you may also enter your business or DBA name on the “Business name/disregarded entity” name line. You may use either your SSN or EIN (if you have one), but the IRS encourages you to use your SSN.

That's straight from the W-9 instructions. You _can_ use an EIN. In my opinion you _should_ use an EIN.

[ Parent | on HN ]
Re:FTC takes action against CafePress for data breach cover up by lfowles on Thursday June 30, 2022 @05:25PM (#31938826)
Now I'm even more confused, heh. From the previous page:

> If you are a single-member LLC that is disregarded as an entity separate from its owner, enter the owner’s SSN (or EIN, if the owner has one). *Do not enter the disregarded entity’s EIN*

Edit: I suppose the distinction is that you should have an EIN for your name

[ Parent | on HN ]
Re:FTC takes action against CafePress for data breach cover up by mcculley on Monday June 27, 2022 @04:03PM (#31900019)
Many sole proprietors execute under their SSN. Most will not bother to acquire an EIN.
[ Parent | on HN ]
Re:FTC takes action against CafePress for data breach cover up by olliej on Monday June 27, 2022 @02:38PM (#31898780)
Income reporting? If you’re a non-business merchant? Or if you’re a business the businesses tax is?

This is me stabbing in the dark, no actual knowledge or anything :)

[ Parent | on HN ]