Credit card woes, Whois data: Epik breach

Credit card exposure from breach could have a major impact on clients.

I’ve been writing a lot regarding the Epik security breach, and you can expect to hear a lot more in the coming weeks as more details come out.

Yesterday, I published an email from Epik stating that it might be worth taking precautionary measures with credit card data. If you’ve ever bought anything online, this isn’t the end of the world. Numbers get stolen all of the time, even from the biggest retailers. But in Epik’s case, it appears that the firm was storing CVV codes as well, which is a big no-no. These are the three and four-digit codes that are usually on the back of the card that are used for verification. Merchants are supposed to only use it for authorization and not store the number.

The other big news is that a bunch of scraped Whois records of non-clients were included in the breach. I have a couple of thoughts regarding this.

First, you ought to understand the history of Epik. The firm entered the domain registrar business with the buyout of Intrust Domains in 2011. Intrust was notorious for spamming people to sell them expiring domains. And, although Epik told me at the time that it didn’t acquire the email marketing part of Intrust, Epik itself was known for trying to sell domains via unsolicited email. (In a public video chat regarding the hack, Epik CEO Rob Monster confirmed that the early code base it purchased from Intrust was built on “shitty Russian code”, and that some of it is still in production.)

So it’s no surprise that the firm has lots of Whois data. In fact, I wonder if it has a lot more than what was breached. Last year, Epik’s VP of Communications threatened people who were saying bad things regarding Epik by writing, “I am one of few individuals on this planet with the capacity to email 300 million people in fifteen seconds, with a full media agency and PR firm behind me.” I have no idea where that email data he referred to comes from and where it is stored.

Is the exposed Whois data a big deal? Yes and no. On the one hand, all of this data was public and probably scraped by plenty of spammers. On the other hand, this data can easily be used to spam people now. And certainly, people are going to be upset that their data was re-exposed by a firm they’ve never heard of, so it’s going to be another sizable headache for the domain registrar as it works through recovering from the hack.