Epsilon email hack: customers of Barclaycard US had their names and email addresses stolen. Photograph: David Levene for the Guardian
Computer hackers have stolen the names and email addresses of millions of people in one of the largest internet security breaches in US history.
The names and email addresses of customers of Barclaycard US, Capital One and other large firms were taken in an attack on the marketing email provider Epsilon last week. British customers of Barclays Bank, which owns Barclaycard US, were not affected. A spokesman for Barclaycard US confirmed to the Guardian that it would continue to work with Epsilon despite the breach.
Other information, such as passwords or credit card details, are not thought to have been exposed. However, some banks have warned customers to expect fraudulent emails attempting to solicit further login details.
The UK Information Commissioner's Office (ICO), which investigates data breaches of this kind, said it was making inquiries into whether any Britons were among those affected.
Epsilon, which provides marketing services via email to about 2,500 companies, put a warning on its website on Friday stating that its systems had been "exposed by an unauthorised entry" into its email system. Epsilon said it would not be comment further on the breach when contacted by the Guardian. It is not yet known who perpetrated the attack, which US law enforcement agencies have begun investigating.
"The information that was obtained was limited to email addresses and/or customer names only," Epsilon said in its statement. "A rigorous assessment determined that no other personal identifiable information associated with those names was at risk. A full investigation is currently underway."
Over the weekend, dozens of Epsilon clients began to warn customers that their email addresses may have been stolen. Some of the largest financial institutions in the US, such as JPMorgan and Citigroup, are among the companies affected. Best Buy and Walt Disney subsidiary Disney Destinations also began warning its customers about the security breach. The list of companies affected is expected to continue to grow.
TiVo, the US video-on-demand company, wrote to its customers on Sunday morning: "Please note, it is possible you may receive spam email messages as a result. We want to urge you to be cautious when opening links or attachments from unknown third parties."
A list of millions of email addresses with their source is likely to be incredibly lucrative for so-called "phishing" scams, where credible-looking emails are sent to people soliciting other sensitive information, such as bank account details.
"Losing your email address via a service to which you already belong makes it much easier for scammers to hit you with emails which match your existing interests, at least loosely," said Paul Ducklin of internet security firm Sophos. "That, in turn, can make their fraudulent correspondence seem more believable."
The attack has drawn parallels with other large-scale computer infiltrations, most notably the Heartland Payment Systems breach of 2008. More than 40m bank account details were stolen in that attack, conducted by a criminal gang led by notorious hacker Albert Gonzalez. Gonzalez was later sentenced to 20 years in prison.
Last month an Iranian hacker claimed he stole digital security certificates used for online transactions by some of the web's largest sites, including Google, Yahoo, Microsoft and Skype.
The names and email addresses of customers of Barclaycard US, Capital One and other large firms were taken in an attack on the marketing email provider Epsilon last week. British customers of Barclays Bank, which owns Barclaycard US, were not affected. A spokesman for Barclaycard US confirmed to the Guardian that it would continue to work with Epsilon despite the breach.
Other information, such as passwords or credit card details, are not thought to have been exposed. However, some banks have warned customers to expect fraudulent emails attempting to solicit further login details.
The UK Information Commissioner's Office (ICO), which investigates data breaches of this kind, said it was making inquiries into whether any Britons were among those affected.
Epsilon, which provides marketing services via email to about 2,500 companies, put a warning on its website on Friday stating that its systems had been "exposed by an unauthorised entry" into its email system. Epsilon said it would not be comment further on the breach when contacted by the Guardian. It is not yet known who perpetrated the attack, which US law enforcement agencies have begun investigating.
"The information that was obtained was limited to email addresses and/or customer names only," Epsilon said in its statement. "A rigorous assessment determined that no other personal identifiable information associated with those names was at risk. A full investigation is currently underway."
Over the weekend, dozens of Epsilon clients began to warn customers that their email addresses may have been stolen. Some of the largest financial institutions in the US, such as JPMorgan and Citigroup, are among the companies affected. Best Buy and Walt Disney subsidiary Disney Destinations also began warning its customers about the security breach. The list of companies affected is expected to continue to grow.
TiVo, the US video-on-demand company, wrote to its customers on Sunday morning: "Please note, it is possible you may receive spam email messages as a result. We want to urge you to be cautious when opening links or attachments from unknown third parties."
A list of millions of email addresses with their source is likely to be incredibly lucrative for so-called "phishing" scams, where credible-looking emails are sent to people soliciting other sensitive information, such as bank account details.
"Losing your email address via a service to which you already belong makes it much easier for scammers to hit you with emails which match your existing interests, at least loosely," said Paul Ducklin of internet security firm Sophos. "That, in turn, can make their fraudulent correspondence seem more believable."
The attack has drawn parallels with other large-scale computer infiltrations, most notably the Heartland Payment Systems breach of 2008. More than 40m bank account details were stolen in that attack, conducted by a criminal gang led by notorious hacker Albert Gonzalez. Gonzalez was later sentenced to 20 years in prison.
Last month an Iranian hacker claimed he stole digital security certificates used for online transactions by some of the web's largest sites, including Google, Yahoo, Microsoft and Skype.