Three days following an e-mail support provider notified clientele that its techniques have been compromised, impacted organizations keep on to emerge.
A expanding listing of firms – including Capital 1, U.S. Lender, Citigroup, JPMorgan Chase and Barclays Bank of Delaware – currently are notifying customers that hackers have stolen their e mail addresses.
All the firms use the Dallas-based e mail service provider, Epsilon, which on Friday revealed that hackers gained unauthorized entry to its electronic mail system to steal its clients' customer data.
The breach also affects a number of well-known retailers and hospitality organizations, such as Brookstone, Disney, Fry's, L.L.Bean, Marriott Rewards, New York & Co., Ritz-Carlton Rewards, The College Board, The Home Shopping Network, TiVo and Walgreens
Office 2010 Home And Business Key, according to reports and breach notification letters.
The stolen information includes e-mail addresses and customer names, according to Epsilon's statement. No Social Security numbers or financial information were compromised.
It is unclear how hackers successfully infiltrated Epsilon's network or how many e-mail addresses ended up involved.
Many of the impacted corporations began notifying customers over the weekend about the incident. Customers may receive an increase of spam as a result of the breach, according to several notification letters.
The data could also be used to perpetrate socially engineered attacks, Richard Mackey, vice president of consulting at SystemExperts
Microsoft Office 2007 Standard, told SCMagazineUS.com on Monday. With the knowledge that a particular user did business with a certain company, an attacker would be able to craft real-looking phishing scams.
“Most effective phishing attacks are the ones that have legitimacy,” Mackey said. “The more authentic and targeted they are
Office 2007 Pro Plus, the more convincing they are.”
Users should be especially cautious when opening links or attachments from unknown third parties in light of the incident, impacted brands have warned their customers.
The breach also extends to a number of supermarkets, including City Market, Dillons, Food 4 Less, Fred Meyer, Jay C, King Soopers, Kroger, QFC and Ralphs, according to reports.
Epsilon said it detected the breach on Wednesday. Epsilon is the world's largest "permission-based" electronic mail marketing provider and sends more than 40 billion emails each year, according to the company's website.
The incident mirrors a similar attack, disclosed in December
Windows 7 Pro Key, against Atlanta-based electronic mail marketing services firm Silverpop Methods. That breach impacted a subset of Silverpop's clientele
Office Pro Plus 2007, including McDonald's and social media site DeviantART.
SystemExperts' Mackey said these breaches illustrate the importance of ensuring that third-party service providers that are trusted to maintain a company's information can do so securely.
Before handing over information to third parties, organizations must assess the risks associated with that data and ensure it will be adequately protected, he said. Organizations must then maintain an active relationship with support providers to ensure their protection mechanisms are in line with industry standards.
The organization also should be prepared to react in case of a breach, Mackey added.
Many security rules and regulations require organizations to ensure that their third-party providers exercise due care to protect personal information.
Epsilon and its affected customers, however, likely did not violate any laws because the stolen information was not connected to any other identifying data, such as Social Security or credit card numbers, Mackey said.
“It is admirable, in a sense, that the organizations did make this announcement that the information was compromised, even though they weren't forced by regulation to do so,” he added.