Epsilon may have been tipped off that it was a target

Share this article:

The longtime partner of email marketing services provider Epsilon apparently warned the company last fall that it could be targeted by malware attacks.

In a Nov. 24 note sent by Return Path, which makes email monitoring tools for marketers, Neil Schwartzman, senior director of security strategy, warned of an ongoing "spear phishing campaign" against firms like Epsilon that had the "tremendous potential to damage corporate security."

"Over the course of the past five weeks, spam campaigns have been aimed at the staff members of over 100 ESPs (email service providers) and gambling sites," Schwartzman wrote. "These targets have received emails typically with content that mentions the staffer by name, and purports to be from a couple, presumably friends or co-workers." 

It is not clear if the campaign Schwartzman references is what led to the breach of Epsilon, which resulted in the theft of names and email addresses belonging to millions of customers. An estimated 60 Epsilon corporate clients were affected and forced to notify the victims.

Jessica Simon, spokeswoman for Epsilon, did not respond to a phone call seeking comment on Friday.

Epsilon, one of the world's largest email marketers, released a second statement on Thursday to remind victims that no personally identifiable information, such as credit card or Social Security numbers, were taken in the heist.

Meanwhile, Sen. Al Franken, D-Minn., chairman of the Senate Judiciary Committee's new privacy panel, and Sen. Richard Blumenthal, D-Conn., are among lawmakers investigating.

And the Better Business Bureau warned Thursday that one of the first phishing scams to result from the breach -- targeting customers of Chase Bank, one of the Epsilon clients -- is making the rounds.

Epsilon and Return Path have been partners since at least 2002.

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters


More in News

ISSA tackles workforce gap with career lifecycle program

ISSA tackles workforce gap with career lifecycle program ...

On Thursday, the group launched its Cybersecurity Career Lifecycle (CSCL) program.

Amplification DDoS attacks most popular, according to Symantec

Amplification DDoS attacks most popular, according to Symantec

The company noted in a whitepaper released on Tuesday that Domain Name Server amplification attacks have increased 183 percent between January and August.

Court shutters NY co. selling security software with "no value"

A federal court shut down Pairsys at the request of the Federal Trade Commission.