The fallout from the Epsilon breach

The Epsilon breach took place late last month, but the ramifications could be serious. Tom Brewster looks at what the consequences could be...

From there, even more data can be acquired to garner what the target is interested in or where they work. Then, with a specially crafted email, the customer could be convinced to download a malicious file handing their control over to a hacker.

Such a process has been used in various attacks in recent times. RSA was one notable recent victim of a spear phishing attack.

"The illicitly extracted information from Epsilon, or from any

other company that stores and processes personal data, is very valuable, even though it may not seem much for the untrained eye," Catalin Cosoi, head of online threats lab at BitDefender, told IT PRO.

What makes the Epsilon breach that bit more significant is the number of people who could have been hit.

"We are seeing these [emails] sent to Europeans as well as American citizens," said Carl Leonard, senior manager for security research at Websense.

"Some reports are saying millions of people had their details on the lists that were stolen - that is a lot of people who are now more vulnerable to spam, social engineering attacks targeted to their email address, and of course the subscribers have also experienced a loss of privacy."

The impact on Epsilon

Whatever happens to users, Epsilon will be deeply concerned about the impact of the breach on its own business.

You have to wonder if some of its numerous big-name customers the firm has around 2,500 large companies as clients have sent strongly worded-letters venting their fury at the breach.

"It's not just the reputation of Epsilon that has been negatively impacted but the reputation of the high profile global corporations who have now had to advise their customers that the data breach occurred," Leonard noted.

Cosoi said it would take "some efforts to regain customers' trust," but what if it emerges the breach was worse than first thought? Often, the true connotations of a compromise only become clear in the ensuing weeks and months.

So far, the firms involved have stated only emails and names were leaked.

"If later it becomes apparent that additional pieces of data were also extracted from their networks, this could further erode the trust that clients place in the business," Leonard added.

Epsilon and its clients may also face investigations from regulators on both sides of the pond, including the Information Commissioner's Office (ICO) in the UK.

Of course, time could be a healer for Epsilon and if all keeps quiet for a while, the firm may recover without too much difficulty.

Featured Resources

The ultimate law enforcement agency guide to going mobile

Best practices for implementing a mobile device program

Free download

The business value of Red Hat OpenShift

Platform cost savings, ROI, and the challenges and opportunities of Red Hat OpenShift

Free download

Managing security and risk across the IT supply chain: A practical approach

Best practices for IT supply chain security

Free download

Digital remote monitoring and dispatch services’ impact on edge computing and data centres

Seven trends redefining remote monitoring and field service dispatch service requirements

Free download

Most Popular

HPE wins networking contract with Birmingham 2022 Commonwealth Games
Network & Internet

HPE wins networking contract with Birmingham 2022 Commonwealth Games

15 Oct 2021
Veritas Backup Exec 21.3 review: Covers every angle
backup software

Veritas Backup Exec 21.3 review: Covers every angle

14 Oct 2021
What is cyber warfare?
Security

What is cyber warfare?

15 Oct 2021