Epsilon Data Breach Bigger Than Just Kroger Customers' Data

wiredmikey writes with an update to the previously reported Epsilon breach: "It turns out that Kroger is only one of many customers affected by the breach at Epsilon, which sends over 40 billion emails annually and counts over 2,500 clients, including 7 of the Fortune 10, to build and host their customer databases. It has been confirmed that the customer names and email addresses, and in a few cases other pieces of information, were compromised at several major brands, a list which continues to grow ..." An anonymous reader points out that U.S. Bank is on the list of affected companies; I wonder how many more phishing attempts this will mean.

Comments

collegeboard.com affected

[patmandu]

Just got this email:

CollegeBoard.com
We have been informed by Epsilon, the vendor that sends email to you on our behalf, that your e-mail address may have been exposed by unauthorized entry into their system.

Epsilon has assured us that the only information that may have been obtained was your first and last name and e-mail address. REST ASSURED THAT THIS VENDOR DID NOT HAVE ACCESS TO OTHER MORE SENSITIVE INFORMATION SUCH AS SOCIAL SECURITY NUMBER OR CREDIT CARD DATA.

Please note, it is possible you may receive spam e-mail messages as a result. We want to urge you to be cautious when opening links or attachments from unknown third parties.

In keeping with standard security practices, the College Board will never ask you to provide or confirm any information, including credit card numbers, unless you are on a secure College Board site.

Epsilon has reported this incident to, and is working with, the appropriate authorities.

We regret this has taken place and apologize for any inconvenience this may have caused you. We take your privacy very seriously, and we will continue to work diligently to protect your personal information.

Sincerely,

The College Board

Only Names and Emails?

[longacre]

Usually email marketing databases include a lot more than name and email. They can include identifying demographic info such as home address, sex, age, income, and more to allow for message targeting. Now it's possible that these guys only took names and emails as Kroger and US Bank have announced, but I wouldn't be surprised of Epsilon perhaps underplayed the severity of the breach to their clients.

Re:Only Names and Emails?

[LostCluster]

This wasn't a marketing company, it was an e-mail delivery service. It takes a lot of work to deliver thousands of customized e-mails to a customer base. To get it right, you have to learn the SMTP acceptance policies of various ISPs, deliver up to the limit, and then back off until the timeout resets.

This just goes to show why you only give database slices away, all they needed was the text of the e-mail with the variable spots included, the name to put in the variable slot, and the address to send it to.

It's a spammer's dream to get this many active e-mail addresses released, but it's not the kind of thing that should cause much damage.

if their security is as good as their programmers

[coutch]

.... then we're in trouble

I ran into their awful code back in August, when I was trying to sign in for a Sears email special (hey, I need some cheap tools ...)

the page is still there:
http://www.sears.com/shc/s/dap_10153_12605_DAP_Get%20Connected?adCell=WF

It wouldn't validate my password (say ... for example, "ab1cd2ef"), even though it met all the requirements:

"Password must be at least 8 characters, contain at least one number and one character, not start with a number and not contain any
special characters."

so I dug in a little, and found quite a gem of Javascript !
if (/^[a-zA-Z]+[0-9]+[a-zA-Z]*$/.test(oPass.value) == false) {
                alert(invalidMsg);
                oPass.focus();
                return false;
        }

it won't handle the two numbers ...

try it ... go to the sears link up there, and try registering with a password like ("ab1cd2de") ... don't worry, it won't work, so your (hopefully fake) email will be safe ...

if you want to see what's happening, have a look at the script.js file, and searh for the function verifyPass() ...
you can even see some commented out code of their previous attempts at implementing this basic functionality ...

I emailed Sears back in August, telling them where the error was, and a simple way to fix the regex used ... but all I got was an "out of office reply"

ah we.. I still managed to register after all, and have bought a few tools on sale ...