Epsilon email security breach hits 50 clients
JPMorgan Chase and Citigroup among those firms affected
By Robert McMillan | Published: 10:10, 05 April 2011
About 50 companies were affected by a major security breach at email service provider Epsilon Interactive that caused many US corporations to warn their customers of online attacks Monday.
Epsilon first warned of the incident Friday, saying that someone had got into company systems and obtained email addresses and names belonging to some of its customers. But it wasn't immediately clear how many of its 2,500 clients were at risk. Epsilon is still being tight-lipped about the problem, but it has now given a clearer picture of how many companies are affected.
In a brief statement posted to Epsilon's website Monday, the company said that "approximately two percent of total clients" - about 50 businesses - were hit.
Related Articles on Techworld
Customers of many of these businesses, which include Target, Citigroup, Tivo and Walgreens, woke up Monday to email warnings, telling them that their email addresses had been stolen and that spam or malicious messages could be coming their way. But so far, Epsilon has refused to provide a detailed list of all companies that were affected.
Companies hire Epsilon to send out a total of more than 40 billion messages on their behalf each year.
With millions of addresses thought to have been stolen, the problem may be worse than many people realize, security experts said Monday.
That's because once scammers know their victims' names and email addresses, along with the companies that they do business with, they can craft very targeted "spear-phishing" email attacks that try to trick victims into revealing more sensitive information such as passwords or account numbers.
"Everybody is downplaying it by saying, 'at least they didn't get financial information'. Well that's true, but what they did get was enough to potentially get financial information [in a phishing attack]," said Neil Schwartzman, executive director with the Coalition Against Unsolicited Commercial Email, a consumer advocacy group based in Montreal.
The IDG News Service has confirmed that the following companies have warned customers about the breach. Because Epsilon is often engaged by business units within these firms, not everyone who does business with these companies has had their email address stolen.
AbeBooks
Ameriprise Financial
Barclays Bank
Best Buy
Brookstone
Citibank
Disney Destinations
Hilton Worldwide
JP Morgan Chase
Kroger
Lacoste
Marriott International
McKinsey Quarterly
New York & Company
Robert Half
Target
Tivo
US Bank
Walgreens
