What To Do After The Epsilon Email Breach?

Millions of names and e-mail addresses of people who patronize several large brand name U.S. companies were breached recently after in an attack on on US marketing firm Epsilon. The firm handles customer communications for many household names and sends more than 40 billion e-mails annually.

I received an email from Hilton HHonors today alerting me that my name and email address were among those in the breach. “We were notified by our database marketing vendor, Epsilon, that we are among a group of companies affected by a data breach,” Hilton HHonors, the Hilton Hotels loyalty program, wrote me. “The most likely impact, if any, would be receipt of unwanted e-mails. We are not aware at this time of any unsolicited e-mails (spam) that are related.”

Email from Hilton HHonors alerting customers to the breach.

The good news is that only email addresses and names were exposed, no further personal information. The bad news is that clever attackers could use what has been breached to gain more information.

The Epsilon breach exposes millions of consumer names and e-mail addresses, associated with particular household brands that these consumers do business with. This collection could be a treasure trove for cyberattackers who could use the information to con unsuspecting individuals out of more valuable information such as credit card numbers and home addresses.

For example, an attacker could craft email messages that look like they come from a trusted brand such as Best Buy or Walgreens and target individuals that are known to be customers of those businesses. An e-mail message could, for example, ask an individual to confirm a recent order or to reconfirm payment. These kind of tactics, called phishing and spear phishing, are known to be effective cyberattacks and are amongst the top complaints received by the FTC and FBI.

What can you do to protect yourself?

In today’s world you unfortunately have to always be on guard for email scams. This breach elevates the risk, if your information was exposed, so:

- Be extra alert to email scams, especially if you have received a warning from a company that your email and name were involved in this breach

- Be aware that companies typically won’t ask you for creditcard information or other personal information in email

- If you are suspicious of an email, go directly to the Web site of the company that purportedly sent it and don’t follow links in the email as those may be fraudulent. Call the company’s number listed on their Web site, not the number in the email as that may be a fake

- You could unsubscribe from email communications and resubscribe using a new email address for commercial communications. That way you know that messages that land in that new inbox are more likely to be genuine as the new address wasn’t part of the breach

- Use the latest security software, including Web security features to protect you from going to malicious Web sites such as phishing sites

Tags: Cybercrime, data breach, McAfee Identity Protection

Comments are temporarily suspended due to blog maintenance, comments will be available again from Monday 21st May.