The fallout from the Epsilon breach
The Epsilon breach took place late last month, but the ramifications could be serious. Tom Brewster looks at what the consequences could be...
From there, even more data can be acquired to garner what the target is interested in or where they work. Then, with a specially crafted email, the customer could be convinced to download a malicious file handing their control over to a hacker.
Such a process has been used in various attacks in recent times. RSA was one notable recent victim of a spear phishing attack.
"The illicitly extracted information from Epsilon, or from any
other company that stores and processes personal data, is very valuable, even though it may not seem much for the untrained eye," Catalin Cosoi, head of online threats lab at BitDefender, told IT PRO.
What makes the Epsilon breach that bit more significant is the number of people who could have been hit.
"We are seeing these [emails] sent to Europeans as well as American citizens," said Carl Leonard, senior manager for security research at Websense.
"Some reports are saying millions of people had their details on the lists that were stolen - that is a lot of people who are now more vulnerable to spam, social engineering attacks targeted to their email address, and of course the subscribers have also experienced a loss of privacy."
The impact on Epsilon
Whatever happens to users, Epsilon will be deeply concerned about the impact of the breach on its own business.
You have to wonder if some of its numerous big-name customers the firm has around 2,500 large companies as clients have sent strongly worded-letters venting their fury at the breach.
"It's not just the reputation of Epsilon that has been negatively impacted but the reputation of the high profile global corporations who have now had to advise their customers that the data breach occurred," Leonard noted.
Cosoi said it would take "some efforts to regain customers' trust," but what if it emerges the breach was worse than first thought? Often, the true connotations of a compromise only become clear in the ensuing weeks and months.
So far, the firms involved have stated only emails and names were leaked.
"If later it becomes apparent that additional pieces of data were also extracted from their networks, this could further erode the trust that clients place in the business," Leonard added.
Epsilon and its clients may also face investigations from regulators on both sides of the pond, including the Information Commissioner's Office (ICO) in the UK.
Of course, time could be a healer for Epsilon and if all keeps quiet for a while, the firm may recover without too much difficulty.
The ultimate law enforcement agency guide to going mobile
Best practices for implementing a mobile device program
Free downloadThe business value of Red Hat OpenShift
Platform cost savings, ROI, and the challenges and opportunities of Red Hat OpenShift
Free downloadManaging security and risk across the IT supply chain: A practical approach
Best practices for IT supply chain security
Free downloadDigital remote monitoring and dispatch services’ impact on edge computing and data centres
Seven trends redefining remote monitoring and field service dispatch service requirements
Free download
