Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Privacy Security Spam Your Rights Online

Epsilon Data Breach Bigger Than Just Kroger Customers' Data 115

Posted by timothy from the trade-loyalty-cards-and-email-addresses dept.
wiredmikey writes with an update to the previously reported Epsilon breach: "It turns out that Kroger is only one of many customers affected by the breach at Epsilon, which sends over 40 billion emails annually and counts over 2,500 clients, including 7 of the Fortune 10, to build and host their customer databases. It has been confirmed that the customer names and email addresses, and in a few cases other pieces of information, were compromised at several major brands, a list which continues to grow ..." An anonymous reader points out that U.S. Bank is on the list of affected companies; I wonder how many more phishing attempts this will mean.
This discussion has been archived. No new comments can be posted.

Epsilon Data Breach Bigger Than Just Kroger Customers' Data More

Epsilon Data Breach Bigger Than Just Kroger Customers' Data

Comments Filter:

  • collegeboard.com affected (Score:5, Interesting)

    by patmandu ( 247443 ) on Saturday April 02, 2011 @11:07PM (#35697378)

    Just got this email:

    CollegeBoard.com
    We have been informed by Epsilon, the vendor that sends email to you on our behalf, that your e-mail address may have been exposed by unauthorized entry into their system.

    Epsilon has assured us that the only information that may have been obtained was your first and last name and e-mail address. REST ASSURED THAT THIS VENDOR DID NOT HAVE ACCESS TO OTHER MORE SENSITIVE INFORMATION SUCH AS SOCIAL SECURITY NUMBER OR CREDIT CARD DATA.

    Please note, it is possible you may receive spam e-mail messages as a result. We want to urge you to be cautious when opening links or attachments from unknown third parties.

    In keeping with standard security practices, the College Board will never ask you to provide or confirm any information, including credit card numbers, unless you are on a secure College Board site.

    Epsilon has reported this incident to, and is working with, the appropriate authorities.

    We regret this has taken place and apologize for any inconvenience this may have caused you. We take your privacy very seriously, and we will continue to work diligently to protect your personal information.

    Sincerely,

    The College Board

    • Re: (Score:1)

      by Anonymous Coward

      I'm a kroger customer. I use their online ordering stuff to have groceries delivered to my home. Yesterday's post said they had notified customers of the breach by email. I've checked. I've received no such email from Kroger or any related Kroger company about *anything*.

    • Got this one too. Who knows what else will be affected?

    • Re: (Score:2)

      by SpzToid ( 869795 )

      This was received by me, 20 hours ago (imagine the address list being used, by Epsilon, to contact ALL their former end-users; not to mention the value to those that possess it now.):

      Important information from McKinsey Quarterly

      We have been informed by our e-mail service provider, Epsilon, that your e-mail address was exposed by unauthorized entry into their system. Epsilon sends e-mails on our behalf to McKinsey Quarterly users who have opted to receive e-mail communications from us.

      We have been assured by

    • I got this one yesterday:

      Dear New York & Company Customer,

      Yesterday, we were informed by our email service provider that your
      email address was exposed by unauthorized entry into their system. Our
      email service provider deploys emails on our behalf to customers who
      have opted into email based communications from us. We want to assure
      you that the only information that was obtained was your name and/or
      email address. Your account and any other personally identifiable
      information were not at risk.

      Please note, it is possible you may receive spam email messages as a
      result. We want to urge you to be cautious when opening links or
      attachments from unknown third parties. We also want to remind you that
      we will never ask you for your personal information in an email.

      We sincerely regret this has taken place, and we apologize for any
      inconvenience this may have caused you. We take your privacy very
      seriously, and we will continue to work diligently to protect your
      personal information.

      Please visit http://faq.nyandcompany.com/ [nyandcompany.com] for answers
      to some frequently asked questions about this incident.

      Sincerely,

      New York & Company

      You've received this message because you registered to receive
      email from New York & Company. If you no longer wish to receive
      email from us, or would like to edit your email preferences,
      click here.
      http://email.nyandcompany.com/p/NYandCompany/OptOut?EMAIL_ADDRESS=nyandcompany_orders@ecuadors.net& [nyandcompany.com]

      Click here to view our Privacy Policy.
      http://www.nyandcompany.com/nyco/company/privacy.jsp?& [nyandcompany.com]

      New York & Company Corporate Office
      450 W. 33rd Street
      New York, NY 10001

      And this one today:

      Dear Guest,

      We have been informed by one of our email service providers, Epsilon,
      that your email address was exposed by an unauthorized entry into that
      provider's computer system. We use our email service providers to
      help us manage the large number of email communications with our
      guests. Our email service providers send emails on our behalf to
      guests who have chosen to receive email communications from us.

      We regret that this incident has occurred and any inconvenience this
      incident may cause you. We take your privacy very seriously, and we
      will continue to work diligently to protect your personal information.

      We want to assure you that your email address was the only personal
      information we have regarding you that was compromised in this
      incident.

      As a result of this incident, it is possible that you may receive spam
      email messages, emails that contain links containing computer viruses
      or other types of computer malware, or emails that seek to deceive you
      into providing personal or credit card information. As a result, you
      should be extremely cautious before opening links or attachments from
      unknown third parties or providing a credit card number or other
      sensitive information in response to any email.

      If you have any questions regarding this incident, please contact us
      at (407) 560-2547 during the hours of 9:00 am to 7:00 pm (Eastern Time)
      Monday through Friday, and 9:00 am through 5:00 pm (Eastern Time)
      Saturday and Sunday.

      Sincerely,

      Disney Destinations

    • We were recently notified by Epsilon, an industry-leading provider of email marketing services, that an unauthorized individual accessed files that included some of our client and consumer information. Epsilon sends marketing and service emails on our behalf but does not have access to sensitive client data such as social security numbers. They have assured us that only names and email addresses were obtained. We take your privacy very seriously and want you to be aware of this.

      Please remember, Ameriprise

    • After nyandcompany.com and disney I got an email from abebooks:

      Epsilon Informs AbeBooks of E-mail Database Breach

      We have been informed by Epsilon, a third-party vendor we use to send e-mails, that an unauthorized person outside their company accessed files that included e-mail addresses of some AbeBooks customers. Epsilon has advised us that the files that were accessed did not include any customer information other than email addresses.

      As a reminder, AbeBooks will never ask customers for personal or accoun

    • Yes, Rest assured nothing important was taken.

      If nothing else, this illustrates that storing data offsite is perfectly safe, and that we should all rush to do this. After all, it's perfectly safe, as the hackers only go after the unimportant stuff. They're nice that way.

    • I got the same email a few days ago and then today got one for Best Buy Reward Zone. Like another post said, must be a massive amount of addresses.

  • tivo (Score:2)

    by Zebai ( 979227 )

    I got a message from tivo today about this exact type of breach, i guess they use this company also although the email was vague on the name of the company and the reason they had my email to begin with.

    • We've got a serious security hole in the Internet that whenever an e-mail needs to be sent, you've got to disclose a destination address to several "why should we trust you?" parties.When you've got a lot to send, you either have to bore yourself setting up a system to get around "You're acting like a spammer" blocks that are different at every ISP or hire this third party that already did that research. When this third party gets hit, everybody's list falls at once.

      If only privacy policy violations came wi

    • I got a message from tivo today about this exact type of breach, i guess they use this company also although the email was vague on the name of the company and the reason they had my email to begin with.

      I got the same message. If my Tivo address is used for spam, it should be reasonably obvious, since I use a unique address for that account.

    • Re: (Score:2)

      by Tihstae ( 86842 )

      Text of Email Message from Tivo:

      Dear TiVo Customer,

      Today we were informed by our email service provider that your email address was exposed due to unauthorized access of their system. Our email service provider deploys emails on our behalf to customers who have opted into email-based communications from us.

      We were advised by our email service provider that the information that was obtained was limited to first name and/or email addresses only. Your service and any other personally identifiable information w

  • Paul Erdos would not have been surprised (Score:2, Funny)

    by Anonymous Coward

    Erdos, who never married, would greet the sight of a colleague's toddler by exclaiming, "Aha, an epsilon!" Even an absent-minded mathematician would have realized that you don't put customer data in the custody of an Epsilon.

  • Only Names and Emails? (Score:5, Interesting)

    by longacre ( 1090157 ) on Saturday April 02, 2011 @11:13PM (#35697408) Homepage
    Usually email marketing databases include a lot more than name and email. They can include identifying demographic info such as home address, sex, age, income, and more to allow for message targeting. Now it's possible that these guys only took names and emails as Kroger and US Bank have announced, but I wouldn't be surprised of Epsilon perhaps underplayed the severity of the breach to their clients.

    • Usually email marketing databases include a lot more than name and email.

      Perhaps you are correct. However, I just got an email from that claims that only my name and email address were compromised. Exactly what data was compromised may depend on the particular company's relationship with Epsilon.

    • Re:Only Names and Emails? (Score:5, Informative)

      by LostCluster ( 625375 ) * on Sunday April 03, 2011 @12:19AM (#35697650)

      This wasn't a marketing company, it was an e-mail delivery service. It takes a lot of work to deliver thousands of customized e-mails to a customer base. To get it right, you have to learn the SMTP acceptance policies of various ISPs, deliver up to the limit, and then back off until the timeout resets.

      This just goes to show why you only give database slices away, all they needed was the text of the e-mail with the variable spots included, the name to put in the variable slot, and the address to send it to.

      It's a spammer's dream to get this many active e-mail addresses released, but it's not the kind of thing that should cause much damage.

  • because this kind of crap can happen to you. Might not matter for your personal computer, but if you are a corporate account, it could destroy your company.
    • If this had anything whatsoever to do with the cloud you might have a point. As it is you just show a biased frustration with cloud technology that leads you to blame it for unrelated things.

  • One can only hope... (Score:3)

    by lavagolemking ( 1352431 ) on Saturday April 02, 2011 @11:31PM (#35697482)

    One can only hope this sheds some light on the way companies routinely share otherwise personal information without full disclosure. Maybe if enough people see the people see all their information being compromised by 3rd-party affiliates they never heard of they'll realize what's going on. They just don't seem to realize (or care) that just by filling out 1 form and handing it to 1 company, dozens of other partner/contractor/affiliate companies get a copy and will likely keep it forever.

    It's even worse when they do it with social security numbers or financial data. My school routinely hands social security numbers to other companies as a way of "minimizing liability" because if something happens then they can blame the contractor, as if that somehow minimizes the risk to students. I see this sort of thing happen all to often and it saddens me.

  • Idiots! (Score:3)

    by snowgirl ( 978879 ) on Saturday April 02, 2011 @11:38PM (#35697510) Journal

    These people are idiots of outsourcing private information like that... that's why I keep all my customer data on my little notepad, which is.. right... um... around here somewhere... hm... oh well, I'm sure I'll find it eventually.

  • Yet another example of why I'm inclined to avoid "cloud" (once known as hosted) services. Your data is at the mercy of people of unknown competency, working for companies with limited responsibility and questionable longevity.

    • Data security doesn't matter where the data is located. It matters EVERYWHERE data is located. Incompetency is everywhere.

      Standard reply: nothing is foolproof because fools are so ingenioius.

      • Data security doesn't matter where the data is located. It matters EVERYWHERE data is located. Incompetency is everywhere.

        All the more reason to take ownership of your data and to get the best people you can to manage it. Would you trust a complete stranger with your child? Then why should you trust a stranger with your confidential customer data? *If* it really matters you need to *treat it* as if it really matters.

    • This isn't really a problem with "the cloud" as much as a "single point of failure" situation. With the magic of delivering thousands of e-mails without being marked as spam being held by a tight few, the major companies have no hope of employing a full-time E-mail Manager, they hire a third party to send the e-mail, and this really popular third party got hit with an intrusion attack. Oops.

  • US Bank Email (Score:3, Informative)

    by Anonymous Coward on Sunday April 03, 2011 @12:48AM (#35697732)

    Here is the US Bank email I just got...

    As a valued U.S. Bank customer, we want to make you aware of a situation that has occurred related to your email address.

    We have been informed by Epsilon Interactive, a vendor based in Dallas, Texas, that files containing your email address were accessed by unauthorized entry into their computer system. Epsilon helps us send you emails about products and services that may be of interest to you.

    We want to assure you that U.S. Bank has never provided Epsilon with financial information about you. For your security, however, we wanted to call this matter to your attention. We ask that you remain alert to any unusual or suspicious emails.

    Please remember that U.S. Bank will never request information such as your personal ID, password, social security number, PIN or account number via email. For your safety, never share this or similar information in response to an email request at any time. To learn more about recognizing online fraud issues, visit:
    http://www.usbank.com/cgi_w/cfm/about/online_security/online_fraud.cfm

    In addition, if you receive any suspicious looking emails, please tell us immediately.
    Call U.S. Bank Customer Service at 800-US-BANKS (800-872-2657).

    The security of your information is important to us, and we apologize for any inconvenience this may have caused you. As always, if you have any questions, or need any additional information, please do not hesitate to contact us.

    • Re: (Score:1)

      by tresho ( 1000127 )
      I got the same email from US Bank at about the same time. Time to change my password with them.
      • I got one too and immediately changed my e-mail address only to get another one a few minutes later with the new e-mail address say it had been compromised. Whoo, WTF?

  • if their security is as good as their programmers (Score:5, Informative)

    by coutch ( 157269 ) on Sunday April 03, 2011 @12:51AM (#35697740)

    .... then we're in trouble

    I ran into their awful code back in August, when I was trying to sign in for a Sears email special (hey, I need some cheap tools ...)

    the page is still there:
    http://www.sears.com/shc/s/dap_10153_12605_DAP_Get%20Connected?adCell=WF [sears.com]

    It wouldn't validate my password (say ... for example, "ab1cd2ef"), even though it met all the requirements:

    "Password must be at least 8 characters, contain at least one number and one character, not start with a number and not contain any
    special characters."

    so I dug in a little, and found quite a gem of Javascript !
    if (/^[a-zA-Z]+[0-9]+[a-zA-Z]*$/.test(oPass.value) == false) {
                    alert(invalidMsg);
                    oPass.focus();
                    return false;
            }

    it won't handle the two numbers ...

    try it ... go to the sears link up there, and try registering with a password like ("ab1cd2de") ... don't worry, it won't work, so your (hopefully fake) email will be safe ...

    if you want to see what's happening, have a look at the script.js file, and searh for the function verifyPass() ...
    you can even see some commented out code of their previous attempts at implementing this basic functionality ...

    I emailed Sears back in August, telling them where the error was, and a simple way to fix the regex used ... but all I got was an "out of office reply"

    ah we.. I still managed to register after all, and have bought a few tools on sale ...

    • I get bitten by incompetent validation fairly often. A password should not be accepted which is too long without throwing an error, and yet often times I set a 20 character password only to find out later that the maximum length is 16 and that they ignored those last 4 characters.

    • Not to argue with your point about the validation, but the chances that Epsilon had anything to do with implementing that Sears.com login page are virtually nil.

      • A lot of email marketing companies provide "landing page" coding as well. Though you may be right in this case.

      • Re: (Score:2, Informative)

        by Anonymous Coward

        Actually, the signup.aspx is in an iFrame on Sears that is pulled from Epsilon.com. So yes, Epsilon is the coder of the crap. A simple series of Test cases and some Googleing could have fixed that.

        I too hate that when you are browsing a site that got something wrong and you try to point out how to fix it, since you are a customer and would like it to work in your browser of choice, and the company totally blows you off. When somebody gives you that detailed of an explanation about your problem, you should l

    • Nice catch on the front-end... now, what happens when you turn off Javascript? Do they use the same regex on the back-end? Do they check on the back-end?

      Just curious, as I haven't had time to check for myself...

      • Re: (Score:1)

        by coutch ( 157269 )

        They must use a different one, I "forced" the bad password through, and it worked just fine (at least it did 8 months ago)

    • Re: (Score:1)

      by xystren ( 522982 )

      if their security is as good as their programmers .... then we're in trouble

      This reminds me of the old computer laws I had on a mug in the early '80s... If construction workers built buildings the same way that programmers built programs, the first woodpecker that came along would destroy civilization.

  • Whether epsilon has more or less info to disclose isnt as worrying as the companies that hire them. Kroger's and Brookstone don't typically have copie of all your financial information. College Board, who also run the financial aid application system for lots of colleges, has copies of 1040s, w2s, assets, etc.

    • Whether epsilon has more or less info to disclose isnt as worrying as the companies that hire them. Kroger's and Brookstone don't typically have copie of all your financial information. College Board, who also run the financial aid application system for lots of colleges, has copies of 1040s, w2s, assets, etc.

      Whew! All I can say is - thank goodness Epsilon's not in charge of RSA token security! If that got breached we'd be in REAL trouble!

    • Re: (Score:2)

      by nurb432 ( 527695 )

      Kroger does have quite a bit, if you use their pharmacy, due to all the wonderful regulations.

      Not saying that was part of the data they would send to a spam haus, but don't stick your head in the sand that they don't have a lot more data internally.

  • 1) Find random email spam list on internet
    2) Claim it is the "FAMOUS" list from Epsilon
    3) Sell to spammers @ premium rate
    4) PROFIT !!!

  • Man: Well, what've you got?
    Waitress: Well, there's egg and bacon; egg sausage and bacon; egg and spam; egg bacon and spam; egg bacon sausage and spam; spam bacon sausage and spam; spam egg spam spam bacon and spam; spam sausage spam spam bacon spam tomato and spam;
    Vikings: Spam spam spam spam...
    Waitress: ...spam spam spam egg and spam; spam spam spam spam spam spam baked beans spam spam spam...
    Vikings: Spam! Lovely spam! Lovely spam!
    Waitress: ...or Lobster Thermidor a Crevette with a mornay sauce serve

  • PayPal (Score:3)

    by EdIII ( 1114411 ) on Sunday April 03, 2011 @03:18AM (#35698028)

    Well we know the phishing attempts on PayPal might increase by .000000000000000000000000000000000000000000001%.

    My really old email address gets about 50 (about a dozen unique) different PayPal phishing attempts *per day*.

    I initially (even though I hate the bastards) did what I thought was the right thing and reported them, but after awhile it was like using a teaspoon to bail the water out of a sinking ship :)

  • And the store wonder why... (Score:1)

    by Anonymous Coward

    I refuse to give them my private information just to shave a few points off of my shopping bill. How much is your personal private information worth? Quite a lot, apparently...

  • Comment removed based on user account deletion
  • If they have the email address and name of the associated company, phishing attacks may just be one way to use it. The could conceivably attempt to reset passwords at sites that let you do that with a security question (unlikely, given the time and effort required) or attempt to combine that data with password info stolen from a major email program and then reset passwords and steal them.

  • From TFA: "Citi also warned customers over Twitter about the incident"

    So unless we're members of the twittering classes we're not deserving of notifications when a security breach occurs. Glad I'm not one of Citi's customers.

    • #doh #sorry #yerscrewed #citibankisanawardwinningbankforexcellencyincustomerservice We value your bit.ly/

    • Re: (Score:2)

      by Tihstae ( 86842 )

      Well, Epsilon is a bit busy right now dealing with the compromise so Epsilon is probably waiting for Citi's check to clear before sending out the notice for Citi that Epsilon was hacked.

      Figure out how to get around being called a spammer
      Get lot of businesses to pay you for this knowledge
      Get hacked.
      Profit

  • Text of e-mail from Disney this morning:

    Dear Guest,

    We have been informed by one of our email service providers, Epsilon,
    that your email address was exposed by an unauthorized entry into that
    provider's computer system. We use our email service providers to
    help us manage the large number of email communications with our
    guests. Our email service providers send emails on our behalf to
    guests who have chosen to receive email communications from us.

    We regret that this incident has occurred and any inconvenience

  • It's a little creepy how the securitylink page, linked to in the summary, asks you to give them your email address before you read the page...

  • I checked Epsilon's website. There are no IT Security jobs posted. Wonder how long it will be before that changes.

  • TiVo (Score:2)

    by cstacy ( 534252 )

    TiVo notified me today of the breach.

  • US Bank already sucked, their website sporting the worst GUI since Windows 3. I had an REI Visa with them, their website would show me paid with zero balance even though I was carrying, and wouldn't let me add a payment, but then would suddenly show me overdue and add a late fee. I'd call up, they'd sometimes credit me, and it would start all over again. For over a decade I had no missed payments, suddenly I was having one every month.

    It got fixed the day the new regs took effect, up to that point they w
  • Some of you understand the software engineering of this a lot better than I do. Can, or how can, we prevent and deal with these crimes on the technical side? I'm a retired lawyer with medical and other privacy law expertise and this is just one of many areas where our legal system doesn't work except for the vrey rich criminals. If there is any advice you technical experts can give Congress while they are working on yet another computer privacy bill right now, please do so and please publish your advice

  • Dear Valued Best Buy Customer,

    On March 31, we were informed by Epsilon, a company we use to send emails to our customers, that files containing the email addresses of some Best Buy customers were accessed without authorization.

    We have been assured by Epsilon that the only information that may have been obtained was your email address and that the accessed files did not include any other information. A rigorous assessment by Epsilon determined that no other information is at risk. We are actively investigating to confirm this.

    For your security, however, we wanted to call this matter to your attention. We ask that you remain alert to any unusual or suspicious emails. As our experts at Geek Squad would tell you, be very cautious when opening links or attachments from unknown senders.

    In keeping with best industry security practices, Best Buy will never ask you to provide or confirm any information, including credit card numbers, unless you are on our secure e-commerce site, www.bestbuy.com. If you receive an email asking for personal information, delete it. It did not come from Best Buy.

    Our service provider has reported this incident to the appropriate authorities.

    We regret this has taken place and for any inconvenience this may have caused you. We take your privacy very seriously, and we will continue to work diligently to protect your personal information. For more information on keeping your data safe, please visit:
    http://www.geeksquad.com/do-it-yourself/tech-tip/six-steps-to-keeping-your-data-safe.aspx [geeksquad.com].

    Sincerely,

    Barry Judge
    Executive Vice President & Chief Marketing Officer
    Best Buy

    I like that they turned it into an opportunity to plug Geek Squad as well.

Slashdot Top Deals

"Protozoa are small, and bacteria are small, but viruses are smaller than the both put together."

Close