Epsilon may have been tipped off that it was a target

The longtime partner of email marketing services provider Epsilon apparently warned the company last fall that it could be targeted by malware attacks.

In a Nov. 24 note sent by Return Path, which makes email monitoring tools for marketers, Neil Schwartzman, senior director of security strategy, warned of an ongoing "spear phishing campaign" against firms like Epsilon that had the "tremendous potential to damage corporate security."

"Over the course of the past five weeks, spam campaigns have been aimed at the staff members of over 100 ESPs (email service providers) and gambling sites," Schwartzman wrote. "These targets have received emails typically with content that mentions the staffer by name, and purports to be from a couple, presumably friends or co-workers." 

It is not clear if the campaign Schwartzman references is what led to the breach of Epsilon, which resulted in the theft of names and email addresses belonging to millions of customers. An estimated 60 Epsilon corporate clients were affected and forced to notify the victims.

Jessica Simon, spokeswoman for Epsilon, did not respond to a phone call seeking comment on Friday.

Epsilon, one of the world's largest email marketers, released a second statement on Thursday to remind victims that no personally identifiable information, such as credit card or Social Security numbers, were taken in the heist.

Meanwhile, Sen. Al Franken, D-Minn., chairman of the Senate Judiciary Committee's new privacy panel, and Sen. Richard Blumenthal, D-Conn., are among lawmakers investigating.

Epsilon and Return Path have been partners since at least 2002.