E-commerce and data security.
The phishers' big catch.
A large theft of company e-mail lists causes controversy.
Apr 7th 2011
AN OUTRAGED consumer-advocacy group is calling it “the Fukushima of the e-mail industry”. Comparing mere data theft to Japan’s nuclear nightmare is perhaps a bit over the top. But the theft of data from Epsilon, a marketing-services company, has nonetheless caused widespread concern. On April 1st Epsilon revealed that an outsider had managed to get hold of the e-mail addresses and names of some individuals that it held on its system. Many millions of records are reportedly involved, although Epsilon, which is still investigating the cause of the leak, refuses to confirm the exact number.
This is hardly the first time that a big security breach has led to the mass theft of digital data. But the fallout from the Epsilon debacle will spread far and wide.
The company sends out more than 40 billion e-mails a year on behalf of many of America’s biggest companies, including Target, one of the country’s largest retailers, JPMorgan Chase, a bank, and the McKinsey Quarterly, a management journal. Marks & Spencer, a big British retailer, was also among those whose e-mail list was stolen.
Epsilon says that only 2% of its 2,500 clients have been affected by the leak, but given the size of some of those outfits, this is not much consolation. Many of the firms involved have been struggling this week to let their customers know—by e-mail, inevitably—that their personal data may have been compromised.
Some security experts argue that the fuss over the leak is overblown. They say that e-mail addresses are far less sensitive pieces of information than, say, medical or financial records. People often post their addresses on their Facebook pages, or print them on their business cards. Bruce Schneier, an internet-security expert, thinks it is a bit like worrying about spammers stealing a copy of the telephone directory. All it would do is make their task a bit easier.
Other observers are taking the leak more seriously because the thief stole, in effect, companies’ customer lists and this would allow anyone who buys the lists to aim carefully crafted e-mails at those customers that appear to come from trusted businesses, asking them to “update your account details” or otherwise reveal further sensitive information, a scam known as “spear-phishing”. Condé Nast, publisher of Vogue, recently lost almost $8m after falling for a fake e-mail purportedly from one of its printers, asking it to divert payments to a different bank account.
It will certainly damage the reputations of the firms that gave Epsilon their customers’ data. Many of them, including Marriott International, a hotel chain, have been quick to blame the marketing firm for the leak and to alert their customers to the risks. But this may not be enough to spare them from criticism.
Customers may ask themselves whether companies that cannot keep a simple e-mail list safe can be trusted with more sensitive things, like their credit-card details. They also have reason to worry that other, more serious, leaks are being hushed up.
“The Epsilon case is just the public tip of an iceberg,” says Jeff Hudson of Venafi, a data-security firm. Many instances of data loss, he says, are simply not reported.
Epsilon’s leak comes at a time when the authorities in America are taking a hard look at the way people’s electronic data are dealt with. On April 4th it emerged that federal prosecutors in New Jersey are examining how software applications for smartphones collect and share data, amid suspicions that privacy laws have been broken in some cases. Government officials are also formulating new online-privacy rules that will give people greater control over the way information is collected about them on the web.
The Epsilon episode will surely encourage them to take a strict line on all sorts of data-handling.