Epsilon Email Marketing Data Breach

What happened

On March 30, 2011, unauthorized individuals accessed Epsilon's email system. They stole the names and email addresses of customers from numerous high-profile clients, including JPMorgan Chase, Capital One, Best Buy, and TiVo.

Technical mechanism

The attackers reportedly used spear-phishing campaigns targeting Epsilon employees to install malware, gain backdoor access, and steal credentials, which were then used to exfiltrate the email databases.

Why it matters

As one of the largest data breaches at the time, it highlighted the risks of concentrating vast amounts of customer data within third-party marketing providers and fueled subsequent targeted phishing campaigns.

Impact

Millions of customer records were exposed. While highly sensitive data like credit card numbers was not stolen, the targeted email lists were used for sophisticated, highly convincing phishing and spam campaigns.

Response

Epsilon notified its clients, who in turn warned their customers to be vigilant against phishing attempts. Federal authorities later indicted three individuals for their roles in hacking ESPs, including Epsilon.

Defensive lessons

• Third-party service providers must be held to strict security standards.
• Even seemingly low-risk data (names and emails) can be weaponized for targeted social engineering.
• Organizations must monitor and secure their email marketing infrastructure.

Evidence register

1. SEC — Alliance Data Systems Corporation Form 10-Q (verified)
2. Krebs on Security — Feds Indict Three in 2011 Epsilon Hack (verified)