News

The fallout from the Epsilon breach

The Epsilon breach took place late last month, but the ramifications could be serious. Tom Brewster looks at what the consequences could be...

6 Apr 2011

ANALYSIS: The hack attack on Epsilon last week has caused tremors across the security industry, as big corporations saw their email lists go missing.

Some giants of the business world - including Marks & Spencer, Hilton and Citibank - were thought to have been affected.

At the minute, it appears as though only email addresses and names went missing. But whilst this kind of information may not seem important at first, it could be used in wider attacks.

So how serious was the Epsilon breach and what can we expect to see in the aftermath?

Does it matter?

You may think hackers can't do much with just emails and names, and to some extent you'd be right. Spam may cause issues for bandwidth and email clogging, but often filtering systems protect users.

In fact, there is a theory going around the hackers didn't even set out to acquire emails from Epsilon, but came across them by accident. This could indicate the cyber criminals weren't doing anything particularly serious.

"Because e-mail addresses were not considered of great value in the criminal underground, I suspect the attack on Epsilon began as something random," said Mary Landesman, market intelligence manager at Cisco.

"Hackers often scan the internet looking for machines that have a certain vulnerability or misconfiguration and then, once they hit upon something, look further to see if the victim interests them."

She added: "At this stage we can only speculate that this is what happened; the attackers had found themselves on Epsilon's system, realised what they had and then worked to acquire their customer lists."

However, you can do more with emails and names than you might think. Such information can provide the building blocks for something much more serious.

In light of recent Advanced Persistent Threat (APT) attacks, people should be more concerned about targeted spear phishing attacks than spam.