The Epsilon data leak incident was serious, as it exposed a large number of people to an attack called “spear phishing,” whereby an attacker targets specific users or organizations with attempts to steal personal information.
However, it is also important to realize this incident could have been much worse, said Nick Feamster, assistant professor at Georgia Tech’s College of Computing and researcher at the Georgia Tech Information Security Center.
Quite a few third-party organizations, ranging from identity management companies and large cloud service providers, like Google, have aggregated large amounts of personal information in one place, making users increasingly vulnerable to the type of attack we saw with Epsilon, whereby a single breach can result in the compromise of a large amount of user data, Feamster said.
Epsilon Interactive, a subsidiary of Alliance Data Systems Corp., was one of the largest data thefts in the history, where hackers were able to steal millions of email addresses from the online marketing company.
The company has not divulged much detail about the attack, but it said nearly 2 percent, about 50 companies, are affected.
Epsilon sends out more than 40 billion messages on behalf of its client companies every year.
Two lessons we should take away from this incident is one, we must raise our own awareness about data storage areas and become more cognizant of how users make themselves vulnerable to these types of incidents, Feamster said. Two, we need better security tools: Software will remain vulnerable, and compromise is inevitable.
Although this may be one of the largest data leaks we have seen in U.S. history, this is not the first instance of a serious data leak. In the past, we have seen data leaks involving the breach of more sensitive information, including credit card numbers and even Social Security numbers, Feamster said. Facing the stark reality these compromises are likely to continue and worsen, we must develop better tools for prevention and auditing.
Feamster offered some tips on what users can do to minimize a data breach:
- Safeguard passwords for sites that hold your data. In particular, do not use the same password for a site like Google as you may use for other sites. This may at least reduce the risk a breach of your password on another site would result in your password on a “higher value” site also being available.
- Try not to store information related to your identity in these services. Specifically, users might want to be careful about documents that contain Social Security numbers, birthdates, credit card numbers, passwords to other accounts (such as bank accounts), and other information.
- Be aware of phishing attacks, and pay attention to any request to “reset” your password on a high-value site. These sites, as a general rule, will never send you a link by email asking you to enter your password. Pay particularly close attention to any message that comes via email asking you to click on a link where you can enter a password.
- Be on the lookout for suspicious login activity patterns to your account. Sites such as Google provide information about where on the network your account was last accessed from (there is typically a link at the bottom of the website for this). You might want to periodically check this information, to make sure you recognize access points for your account.
- Take note of what sensitive data you may have stored in these services. If a data breach occurs, you will want to assess the worst-case scenario and take measures to protect yourself from fraud or identity theft.