Epsilon a Victim of Spear-Phishing Attack, Says Report (update/correction)
Jaikumar Vijayan follows up on the news story by iTnews, mentioned earlier today, which reported that the Epsilon attack was a spear-phishing attack that resulted in the downloading of malware. Jai makes a point of noting, however, that there’s no proof or confirmation yet from Epsilon that this was a spear-phishing attack. As I commented earlier today, although iTnews claimed that it was “revealing” the type of breach and I suspect
Neil Schwartzman of CAUCE is quite correct in his opinion on this, there’s not yet any confirmation that this is what happened this time.
It’s not clear whether anyone at Epsilon, or Silverpop saw the alert, or how they may have responded if they did.
Neither email service provider responded to a Computerworld request for comment today.
According to ITNews, the breaches at Silverpop and Epsilon in the weeks that followed were caused by spear these phishing attacks.
Read more on CIO.
Could Epsilon have known about this type of attack to proactively prevent it? Absolutely.
Should they have known about it in November when it was reported by Return Path and Brian Krebs of KrebsonSecurity.com? Absolutely.
Did they know back then? They haven’t said.
What did they do if they did know back then? They haven’t said.
And that’s why we need a Congressional or legal inquiry into this breach. And we need to get other ESPs under oath to answer the question of whether they, too, were breached back in November or more recently.
Updated: As Neil Schwartzman noted in a comment under another blog entry, he didn’t claim that the Epsilon breach was due to this type of attack. According to Neil, “They used 4-month old quotes to draw a causal link. This could just as easily be copycats exploiting another vector. We simply don’t know.”
iTnews got ahead of the story, it seems.