As email-marketing company Epsilon continues to deal with the fallout related to the revelation that some of its clients’ customer data has been exposed to a third-party, it becomes clear that this incident affects all service providers as organizations renew their focus on data security. In addition, this latest data breach calls into question how secure information is within a cloud-computing infrastructure.
Epsilon reported April 1 that it detected an “unauthorized entry” into its email system and discovered that email addresses and names belonging to a “subset” of its clients had been exposed to attackers.
The company estimated that the attack affected 2 percent of its approximately 2,500 clients. Despite the size of the breach, some affected companies and customers have taken heart in the fact that the stolen data included “only” email addresses, as opposed to personally identifiable information, such as social security numbers.
Still, it means customers are in for more spam, and that leads to questions about whether people can trust something as simple as an email address to a retail store or hotel chain.
“Any company that is privileged to manage the information that a company maintains about its customers should be paying attention,” said Dave Frankland, principal analyst at Forrester Research.
Most of the individuals receiving notification emails about the breach have never heard of Epsilon. The data loss doesn’t affect their perception of Epsilon. However, the breach has affected customers’ relationships to the name-brand banks, travel companies or retail outlets that have had to send out notifications that email addresses have been compromised, said Frankland.
“Customers will surely start to wonder if they can’t trust these firms with their email addresses. [They ask themselves if it’s] really that smart to trust them with their credit card data, or with their mortgage,” Frankland said.
The resulting loss of trust and consumers’ perception that companies shouldn’t have outsourced even the “innocuous” data may force organizations to reassess their marketing strategy. The kind of targeted marketing that Epsilon and similar firms do, such as marketing a mink coat to consumers in Ohio but not to Miami residents, is often beyond the organization’s capabilities. But now organizations have to recognize the risks to the brand and consumer trust by continuing to work with an external marketing provider, Frankland said.
The Epsilon episode raises additional concerns about how secure any data is within a cloud-computing infrastructure, especially as the technology becomes more mainstream.
Cloud adoption, while strong, has been hampered somewhat with concerns about data security in a multi-tenant deployment, and the Epsilon breach brought those concerns back to the forefront. A single system, when broken into, gives the perpetrator potential access to a wealth of data, Frankland said.
Marketing providers are “always keenly aware” of the “vulnerability present” in a single platform where many clients share a common email-sending platform for list-management, email-campaign development, deployment and reporting, said Al DiGuido, CEO of Zeta Interactive and the former CEO of Epsilon.
Email Service Providers, or ESPs, took “extensive measures” to manage the “unique challenges” inherent in a shared environment, DiGuido told eWEEK.
Data security is a constant discussion point within every ESP, with “an incredible focus on tools, policies and monitoring technologies” to prevent unauthorized access to the email-sending infrastructure, DiGuido said. For example, it’s an industry best practice that personally identifiable information is never comingled with marketing data, so attackers can’t connect the two pieces of data, he said. Random security audits are performed to check for potential attack entry points. Each client’s information is also partitioned to keep the data separate and secured independently.
From an “outsider position,” DiGuido thought it likely the attackers somehow compromised the application layer access codes, which tricked the application into thinking the intruder was authorized to interact with the system and databases. The partitions that separated individual clients from each other must have also been compromised,” he said.
“It’s unclear as to how this could have been accomplished without having access to numerous client-specific access codes,” said DiGuido.
While much of the focus has been on how to avoid future attacks, the risk to retailers and other organizations is “enormous,” Nicholas J. Percoco, senior vice president and head of Trustwave’s SpiderLabs, told eWEEK. “Blaming subcontractors managing the email system doesn’t address the central problem of preventing similar attacks in future,” Percoco said.
DiGuido said it was the ESPs’ responsibility to work with peers to figure out collective ways to defend against these types of targeted attacks.
