Like a lot of you, this week I received several messages telling me my e-mail address had been stolen from a company called Epsilon that provides mass e-mail services to many giant corporations. At the end of this post you’ll find what I believe is the latest list of companies affected. I have heard from four of these companies so far — Best Buy, Chase, Hilton, and Ritz-Carlton, which is interesting because I don’t recall having even stayed at a Ritz-Carlton. From a look at the master list below I’m surprised I haven’t yet heard from Verizon, where I am also a customer. The point of this post isn’t just to print a list of Epsilon customers, but to say how screwed-up and perilous this event is for everyone involved including you and me. Heads should be rolling and there is no evidence yet that they are.
Epsilon, which has millions of consumer e-mail addresses and associated names, was hacked, losing some unstated number of customer files probably numbering in the millions. The affected companies have sent very earnest messages notifying us, expressing hopes that the damage is limited, but urging us to be on the lookout for bad guys messing with our ID’s. What they aren’t saying yet is this: “Epsilon screwed-up so we’re firing their sorry asses and suing them back to the stone age. ”
If Epsilon made such a huge mistake they should be punished. If they are being punished we, as the truly affected parties, should be told that is the case. Better, still, we should be compensated for our inconvenience. This is not business as usual. This is a huge steaming mess. Polite e-mail messages that say almost nothing are not an adequate response.
Here’s why I feel this way and you should too:
This stolen data will be used is for phishing attacks, which is what the companies are warning us to be on the look for. There will be such attacks and telling us to be on our guard won’t stop them from being successful to some degree. It is in my view a woefully inadequate response. Remember these bad guys have a lot of data on us — the name of the company with which we are doing business, our names (in most cases), and our e-mail addresses.
No matter what spin the companies put on it this is huge. Consumers will be compromised and losses in the millions — maybe tens of millions — will be incurred. And I don’t care if the banks say they’ll cover the losses, that never happens gracefully, at least not for me.
People who opted-out with these companies were also exposed. So it isn’t just customers but also former customers and non-customers whose information was stolen. What is the legal exposure there? It’s an issue I haven’t seen discussed anywhere.
What if the bad guys start sending mail to the opt-out people (you know they will) and by doing so cause the affected companies to violate the CAN-Spam Act of 2003? That can cost $16,000 per violation.
But hey, this is a case of simple theft and Hilton can’t be held responsible, can it? It isn’t clear.
Here’s what the Federal Trade Commission says: “The law makes clear that even if you hire another company to handle your email marketing, you can’t contract away your legal responsibility to comply with the law. Both the company whose product is promoted in the message and the company that actually sends the message may be held legally responsible. ”
That’s a giant class action lawsuit just waiting to be filed.
But wait, there’s more! Any company that accepts credit cards can be subject to a security audit. Will these companies listed below pass their next such audit? On the face of it they shouldn’t because their systems have been compromised. Blaming Epsilon doesn’t change that because, as in the FTC example above, the companies can’t simply delegate responsibility. And I sincerely doubt that Epsilon or its parent, Alliance Data Systems, is in a financial position to indemnify all those companies.
Again you might say this is an over-reaction on my part, that cooler heads will prevail. Maybe so, but the ugly truth here that isn’t being addressed is that some — maybe many — of these companies could be hiding a multitude of security sins that would come to light in such an audit. Do they really want to let anyone who knows what they are doing have a close look at systems that may be antiquated or even non-existent?
If this Epsilon mess causes a rash of credit card claims and chargebacks that trigger automatic security audits, then even if the Epsilon event itself is explained-away a lot of these companies will still be in trouble.
The worst part of all, though, is that nobody in this mess is on our side, nobody. Apparently we’re not too big to fail.
Here is what I understand to be the current list of affected companies:
1800-Flowers
Abe Books
Air Miles CA
Ameriprise Financial
Barclays Bank of Delaware
Beachbody
Bebe Stores Inc.
Benefit Cosmetics
BestBuy
Brookstone
Capital One
Charter Communications
Chase
Citibank
City Market
The College Board
Crucial.com
Dell Australia
Dillons
Disney Vacations
Eurosport/Soccer.com
Eddie Bauer
Food 4 Less
Fred Meyer
Fry’s
Hilton Honors
The Home Shopping Network
Jay C
JP Morgan Chase
King Soopers
Kroger
LL Bean
Marks & Spencer (UK)
Marriott Rewards
McKinsey Quarterly
Moneygram
New York & Co.
QFC
Ralphs
Red Roof Inns Inc.
Ritz Carlton
Robert Half
Smith Brands
Target
TD Ameritrade
TIAA-CREF
TiVO
US Bank
Verizon
Viking River Cruises
Walgreens
World Financial Network National Bank
I don’t see how the CAN-Spam Act would apply to the affected companies if the sender of the email is the thief. The email thief is not a contractor for Best Buy.
For example, if *I* send out a spoofed Best Buy email, why would Best Buy be liable for *my* actions?
Let’s get a lawyer or three in here, but my experience is that lawsuits will happen no matter what and companies will pay to avoid prolonged litigation. If people who opted out are nevertheless spammed, the law says negligence is no excuse. By allowing itself to be hacked Epsilon may well have been negligent, but again the law says that doesn’t absolve the list owner from ultimate responsibility. So in this case it may not matter that Hilton didn’t send the spam (worse than spam — malicious phishing) they ENABLED it to be sent. But in the end, only the courts can say for sure. And I think it very likely they will be called upon to do so.
So, if I drive a tractor trailer through your front door, steal your pencil and jab someone in the eye with it……..
Bad analogy. A better analogy is that you take your car to a mechanic, who gives the keys to his teenage brother, who allows the keys to be stolen by a stupid friend of his, who promptly takes off with the car and wraps the car around a tree. The mechanic might still win in court, but the mechanic probably wouldn’t want to have to explain that situation to the insurance company or to other customers.
I’m a property & casualty insurance agent and, in my humble opinion, if the mechanic takes possession of the vehicle he is responsible for what happens so long has he takes due care. Giving the keys to his teenage brother is not reasonable care. Leaving the keys in the car under the floor mat is not reasonable care. Locking the keys in a lockbox is reasonable care.
Did Epsilon take reasonable care? That will have to be investigated. Did the black hatted hackers use a direct exploit to gain access to the servers, or did they use social engineering to gain sufficient access that they could escalate privileges to gain access? Did they use a zero-day exploit, or was the system not properly installed, maintained, or updated?
When any of these companies contracted Epsilon, did they get an indemnification against future liability from Epsilon? If not, then the contracting companies will have to absorb the liability caused by Epsilon’s actions or inactions. This is a vicarious liability which is similar to that which any contractor takes on when subcontracting their business.
This is gonna be messy, and we will be hearing about this for years to come — unless the Republicans in Congress can find a way to make the entire mess “go away”.
Dr Matt: So, if I drive a tractor trailer through your front door, steal your pencil and jab someone in the eye with it……..
But it’s not my pencil. It’s somebody else’s pencil I took into my keeping, while signing a contract to say that I would keep it safely, while also being covered by laws proscribing my culpability should the pencil be stolen.
Scottrade was also affected, since they notified by email of the breach.
Well, PayPal isn’t in the list – that’s what I use to make most of my purchase over the net that require an email address. Pshewwww! (wipes brow). I *do* have auto-pay set up with AT&T Mobility, Sprint, and Sirius XM, but those folks all have my gmail email.
The only one on the list I buy anything from is Target, and that’s only in person with my credit card. I’ve never given them my email address. That’s not to say there’s some other company out there that uses Epsilon, and has my email (Tiger Direct, maybe?), and Epsilon’s done the job of marrying email addresses to credit card numbers.
I think I’m goin’ back to paying for everything in gold dubloons. The convenience of a credit card just doesn’t seem to be worth the exposure.
Target, where I do my shopping, sent me a notifier of the breach. I wondered about my email address and then realized, they have a shared login platform with Amazon.com. Go to Target and check their sign in. They give the option of logging in with an Amazon account. So I wonder why Amazon.com isn’t on this list?
The article at Newsday is showing Amazon.com listed with the Epsilon breach.
https://www.newsday.com/business/buy-from-hacked-companies-check-the-list-1.2803699
Please copy and paste the relevant part (their list) since I doubt if we are going to pay $5 per week to read that link.
That was the most timely column ever by Cringely! I haven’t run across any other good information about this anywhere, but I got some of the “your email was comprised by Epsilon” messages and was worried. Thank you thank you thank you for this info!!!
And yes I know there are other new articles on this out there, but nothing insightful like this column…..
The name on the list that most disturbs me is :Air Miles CA.” They do not do business in the US – only in Canada and Portugal IIRC. So why are they storing customer data in the US, where it is subject to American (no)privacy laws? No doubt it is legal, and they got their customers to sign some “agreement” that had this buried somewhere on page 17, but it is bad practice, and I hope it bites them.
AirMiles CA is a business of LoyaltyOne, which in turn is owned by Alliance Data Systems – also the parent of Epsilon. I’ve no idea how this affects the legality of storing Canadian customers’ information in the US, but there is a family connection.
NB Dell Australia and M&S (UK) are also on the list.
A lucky thing for EMC/RSA that this more visible Epsilon hack came along right on time to distract unwanted attention from their own SecurID token problems.
https://www.rsa.com/node.aspx?id=3872
Everything is broken.
Apparently, the whole *security* paradigm is not working. How many massive breaches is it going to take to move the status quo?
I’m not sure I agree with how big of an issue you think this is; I’ve received tons of phishing emails even before the theft and expect to receive many more regardless. But another potentially large piece of information that the bad guys have is not just “the company” but the COMPANIES. I have accounts with 10 of the businesses on your list, all tied to the same email address. Not sure if the bad guys intend to tie multiple companies together that way but it would certainly make for a more convincing phishing attempt: “We at Verizon want to thank you for being a loyal customer of both Verizon and Target by giving you a $50 Target gift card… just click here…”
[…] I, Cringely: Like a lot of you, this week I received several messages telling me my e-mail address had been […]
Look at the bright side…many more people will be on guard against phishing attacts and spam ads in general. Server-side spam filters are pretty good already (John Dvorak’s “I get no spam”).
Why are companies that we’ve trusted with your information passing it on to Epsilon? That is a basic and fundamental breach of our trust.
I’ve had emails from both Marks and Spencer UK and Play.com, one of the biggest CD / DVD / Blu Ray companies in the UK.
Excellent information and commentary. I agree – we (the consumers) should be compensated for the inconvenience of monitoring our emails as a result of negligence on the part of Epsilon, and inadequacy on the part of merchants that selected Epsilon. And now Epsilon is worried about losing business because of breach? I think that is a joke – right?
Even if the banks waive any fradulent charges on our credit cards, the inconvenience of proving that is time-consuming for which the consumer is not compensated but everyone on the “other” side is paid for giving you as much hassle as possible. You, as the consumer, have to prove you are not a criminal. Believe me, I have been through getting charges waived on a credit card that I reported stolen. It is a painful procedure! And worse, I worked for the bank that issued the card.
I don’t think the consumers are going to stand for the perfunctory “we are sorry” from the corporates.
Three things are at the extreme of understanding today – Technology, Commerce and personal Communications.
They all work in “normal” mode but fail in extremes but all players in the three areas push the boundaries to maximize their share which pushes the mode to extreme and unknown territory. The restoration to normal is impossible because the reference curve has an non 1to1 mapping function that was unforeseen by designer user or legislator. But that gray zone has great potential for so called ‘legal’ profit. And a Wild West state.
That this profit hurts others is irrelevant to the profit taker.
It is what make the Tea Party angry what makes scamers happy and law upholders jobs hard.
The solution is given by Chinese justice or Roman Justice – Death and bankruptcy. And fast! Any thing short are successful acts.Romans prevented mutinies in the ranks by the death of 1in10 – decimate.
The rewards are great the punishment must be greater.
IN commerce two times yearly income! NOT profit! And Death of CEO!
In technology a reversal of the “I accept” rules. Failure of the App is failure to provide a safe product and a court full of peers and judges can show where the failure occurred and inflict hurt.
In communication the perpetrators humiliation.
It wont happen Microsoft and Citi are too influential.
The government has no balls and are owned by others!
Muslim justice demands equal acts done by the victim or his family or money!
Oh and change USA law to fact based law as in France Germany.
You take street views and ‘accidentally’ have machines that tape other information is a fact and that fact is in breach of privacy law THE END. NO lawyers little government cost but a $300000 fine is nothing (France) The fine should be confiscation of ALL data and 10% value of company.
When that fine is paid the hurt would smart and not only to Google.
A second offense fine of 60% of company value, if the company is too dumb to understand if it occurs any where else in world!
The world would return back to the people and not vested interests!
And states would be less in debt.
Ritz-Carlton is owned by Marriott. It could be that you stayed at a Marriott and Marriott then “shared” your information with its subsidiary, the Ritz-Carlton Company. Might be interesting to see how casual sharing of data is within a corporation (and how lax security might be on that data).
When a company asks for my email address, I most always use the name of the company in the email address I provide. If airline “CrashDive” asks me for my email address, they get crashdive@example.com where example.com is my own domain.
I’ve set this up for several reasons, one reason being able to drop email addresses whenever some company makes it difficult for me to opt out. You need to be able to maintain aliases for your own domain but it’s worthwhile for more than just dropping unwanted email.
I do the same but set all email without a valid user on the system to a bulk mail folder which I check every so often.
It’s totally swamped with spam but google catches the majority of that for me.
I agree with your post enitrely.
It is also ironic that to leave a comment I have to leave an email and a name though : >
How do we know that the Epsilon notices themselves are not phishing attacks!
If the email accounts were exposed how is that the password side of the account holdings were not? Beyond Bob’s correct pointing out of what are the legal/fininacial repercussions NOT BEING in the general new – so to do I not hear anything about the possibility of the passwords? If Epsilon had stored emails then why not the passwords for the site accounts?? Futher how many users have the same site account passwords as the email. Probably most.
By be being fully forth coming on email shared -there may be corporate safe feeling of we’ve done all we can do and we’ve informed you of such. So now the burden is on us. If one didn’t change email & all passwords within seconds of the news then we are now to blame if we become victioms of phishing and the like.
Again if Epislon stored the emails for corporations then did they not store the passwords to the accounts?
The idea that Epsilon would have passwords for users’ site accounts is a little silly – they don’t need them in order to send mass mail on a contract basis, and many if not most password systems don’t even store the password itself – just a one-way hash. And “most” people use their email address as the password? Equally silly. However, many of the other comments in this person’s Reply are very valid.
In the past year, I’ve started using cash again instead of card… this kind of story makes me feel even better about that decision.
Ah, I remember Epsilon well. It was the mid-seventies and the boom ot direct marketing. Epsilon was started by a group of Harvard MBAs and focused on list management. Every company in direct mail needed new names to stay alive and Epsilon was there to fill the need. One of their brightest stars was our account representative and later our employee. He would regale us with tales of marketing exploits. One in particular involved a certain tele-evangelist named Falwell who was in dire straights. His ministry near bankruptcy, he turned to these hot shot northern boys for salvation. They put together a total marketing package for him where he would essentially sell plastic Jesus’s and bibles for donations. As the story goes they reused the VCR tapes to copy “off color” videos and had a laugh at the grand game of it all. They turned this railing ministry into $30M in the black. One thing leading to another of course it was Jerry Falwell who in later years formed the Moral Majority into a political force. Plastic Jesus’s and spam e-mails – there seems to be a thread of continuity there.
So what does it mean if Epsilon allowed this breach to happen through negligence? Just saw this article: https://www.itnews.com.au/News/253712,epsilon-breach-used-four-month-old-attack.aspx
This is a good example of why it’s handy to have an e-mail account with Yahoo! Mail Plus (http://overview.mail.yahoo.com/enhancements/mailplus) or something similar. So far, I have seven accounts affected by the Epsilon data breach incident. I simply replaced the affected e-mail addresses with new e-mail addresses. This has happened in the past and will happen in the future, so start preparing now by using an e-mail service that can provide you with multiple e-mail addresses.
Um, Bob, we’re in the Age of Zero Accountability (unless you’re a commoner or worse). So the idea that, “Heads should be rolling” is sadly laughable.
It doesn’t seem to matter how big a disaster strikes or how badly a big corporation screws over its customers or the public. No one at or near the top is ever held responsible for such things anymore.
We’re in the Age of Zero Accountability and we’re here to stay.
Fry’s denies using Epsilon:
From: Brenda Percival
Date: Fri, Apr 8, 2011 at 08:40
Subject: RE: [CASE:67660] Epsilon data breach inquiry
Dear valued Frys.com customer,
We are aware of the Epsilon security breech, we however can assure you that Frys’ Electronics does not or has never used Epsilon.
Thank you for contacting Frys.com.
Please let us know if we can be of further assistance.
Sincerely,
Frys.com
1-877-688-7678 – Toll Free
1-800-856-9800
1-866-596-4152 FAX
http://www.frys.com
Maybe it was the Fry’s grocery store. Or is that owned by the same guys as the electronics retailer?
Everyone. Here’s a tip:
Set up a sepearte email address that you only use for website registrations. In my case, I use “accounts@mydomainname.com” for general registrations. This is really easy to do if you own your own domain name, but it’s not that hard to set up a seperate box on one of the free services either. As long as everything is going well, i just forward them to my personal email box. But when something like this happens, all I have to do is redirect emails that were addressed to the compromised address to a different folder that I can monitor (similar to Outlook’s junk mail folder), and create a new one (maybe “accounts2@…). It always seemed pretty obvious to me that an attack like this was inevitable, so I’ve been doing this for years. And don’t fool yourself into thinking this will be the last attack like this… it is a matter of when, not if it will happen again.
I have been affected by four or five of these companies and have yet to be notified by any of them!
All,
This is trivial compared to the potential exploits from cloud computing. Wait ’til you see what happens when your (or the companies you do business with) info is moved to offshore server farms.
Batten down the hatches, hop in the trenches, and presume that nothing you do online is truly secure. Xamuel’s post above has the right idea.
Some will say I’m a paranoid Luddite. Having been working with computers in various forms for over 40 years, my response is “If 100 million people do a stupid thing, it’s still a stupid thing.”
I got one of those polite messages from Air Miles Canada.
I wonder what Canadian law says about an American firm (Air Miles Canada is owned by LoyaltyOne of Texas) keeping files on Canadians in another country and then losing them.
I’ll be on the lookout for phishing attacks, but my experience in web management has taught me that Bob is 100% right. Even highly intelligent people fall prey to phishing attacks (even ones so unsophisticated they shouldn’t fool a toddler!) so I’ll bet at least dozens, if not hundreds of Air Miles customers will be handing over their Visa and MasterCard numbers to Ilya and Nikolai in that boiler room in St. Petersburg. Out of the millions of Air Miles points collectors in Canada, that’s a drop in the bucket, but for Ilya and Nikolai, it’ll be their ticket to easy street and several dozen private dachas on the Black Sea.
This is not business as usual.
Unfortunately, it is business as usual.
There’s a name for what this data breach enables — it’s called ‘spear phishing’. It’s one thing to get a phishing e-mail with “Dear Valued Customer”, it’s another to get one that says “Dear Mr. Magillicutty,”
So, never use a link in any mail message to get to your bank/retailer/club/organization/etc. — always use your own locally stored bookmark. But you already knew that, right?
[…] I, Cringely » Blog Archive » The Epsilon Syndrome – Cringely on technology (tags: epsilon databreach breach privacy) […]
[…] spear phishing campaign. The venerable Robert X Cringely (@cringely) clearly laid this out in his post on this […]
It must be emphasized that every individual even children have hemorrhoids or piles in their bodies. It is only when these become inflamed and swollen that health problems like bleeding and itching of the anus blood in the stool and physical pain occur. Fortunately most piles resolve on their own so hemorrhoid cures are often unnecessary. However it will help matters along when you adopt the following dietary changes to treat and prevent their recurrence.
What is the best credit card to earn airline miles? All I know about is united because there are no blackouts?
Anyone can get onto and operate on the Internet. However if you don’t follow the rules the world can now ignore and cut you off. In time my email provider’s job will get a lot easier when they start accepting email from only known, trusted mail domains.
rewards zone…
[…]I, Cringely » Blog Archive » The Epsilon Syndrome – Cringely on technology[…]…
Death of the Euro…
[…]I, Cringely » Blog Archive » The Epsilon Syndrome – Cringely on technology[…]…
wedding photographers in rhode island…
[…]I, Cringely » Blog Archive » The Epsilon Syndrome – Cringely on technology[…]…
Free Itunes Gift Card Codes…
[…]I, Cringely » Blog Archive » The Epsilon Syndrome – Cringely on technology[…]…
Tigarete-Electronice.eu – Tigari electronice, Tigara electronica, Accesorii tigari electronice, Consumabile tigari electronice, Ploiesti…
[…]I, Cringely » Blog Archive » The Epsilon Syndrome – Cringely on technology[…]…
You really make it appear really easy together with your presentation however I find this matter to be really something that I believe I would by no means understand. It kind of feels too complicated and very vast for me. I’m having a look forward for your subsequent post, I will try to get the dangle of it!
alojamiento rural en Alicante…
[…]I, Cringely » Blog Archive » The Epsilon Syndrome – Cringely on technology[…]…
blommogram…
[…]I, Cringely » Blog Archive » The Epsilon Syndrome – Cringely on technology[…]…
Magnificent items from you, man. I’ve be aware your stuff prior to and you are simply too fantastic. I really like what you’ve got right here, certainly like what you are saying and the way through which you are saying it. You’re making it entertaining and you continue to care for to stay it sensible. I can’t wait to learn much more from you. That is really a terrific site.
comprar relojes emporio armani online…
[…]I, Cringely » Blog Archive » The Epsilon Syndrome – Cringely on technology[…]…
I installed a Socket Pod Solution with USB and Ethernet Ports to sort that untidy mess on my Desk…
[…]I, Cringely » Blog Archive The Epsilon Syndrome – I, Cringely – Cringely on technology[…]…
stone crusher…
[…]I, Cringely » Blog Archive The Epsilon Syndrome – I, Cringely – Cringely on technology[…]…