Security experts warned Monday that banking customers should worry about a wave of spearphishing attacks utilizing the recently-breached email database stolen from marketing firm Epsilon.
The email addresses leaked during the breach could be used to send targeted attacks to the customers of Epsilon's clients, which include a host of financial services providers such as Barclays Bank of Delaware, CapitalOne, Citibank and JPMorgan Chase. The banks are "freaking out" about the leak, says Avivah Liten, vice-president of security research for analyst firm Gartner.
"The attackers are going to use the records - that's what the banks are worried about," says Litan. "It might not even be focussed on the victim's bank accounts. They might just be interested in using the spearphishing attack to get on the desktop."
Friday, Epsilon warned its corporate customers that their client email addresses had been stolen by an attacker. While the company counts a number of major banks among its customers, other companies - such as Best Buy, Disney Destination, and Tivo - were also affected by the breach.
Epsilon says it continues to investigate the attack.
"The information that was obtained was limited to email addresses and/or customer names only," the company said in a statement. "A rigorous assessment determined that no other personally identifiable information associated with those names was at risk."
The attacks should convince companies to take a second, if not a third, look at their outsourced providers' security. While credit-card information comes with an industry mandated set of security standards, names and email addresses are not protected in the same way.
for more information on this breach and who is at risk.