Spearphishing worries follow Epsilon breach

Security experts warned Monday that banking customers should worry about a wave of spearphishing attacks utilizing the recently-breached email database stolen from marketing firm Epsilon.

Also see: Related breach notification letters

The email addresses leaked during the attack could be used to send targeted attacks to the customers of Epsilon’s clients, which include a host of banks such as Barclays Bank of Delaware, CapitalOne, Citibank and JPMorgan Chase. The banks are “freaking out” about the leak, says Avivah Liten, vice president of security research for analyst firm Gartner.

“The attackers are going to use the records — that’s what the banks are worried about,” says Litan. “It might not even be focused on the victim’s bank accounts. They might just be interested in using the spearphishing attack to get on the desktop.”

Friday, Epsilon warned its corporate customers that their client email addresses had been stolen by an attacker. While the company counts a number of major banks among its customers, other companies — such as Best Buy, Disney Destination, and Tivo — were also affected by the breach.

“Please note, it is possible you may receive spam email messages as a result,” stated an email from video service provider Tivo. “We want to urge you to be cautious when opening links or attachments from unknown third parties.”

Epsilon says it continues to investigate the attack.

“The information that was obtained was limited to email addresses and/or customer names only,” the company said in a statement. “A rigorous assessment determined that no other personally identifiable information associated with those names was at risk.”

The company is the latest breach of a marketing partner that put its clients’ customers at risk. In late February, a breach at advertising firm Unanimis resulted in malicious ads appearing on Web sites such as the London Stock Exchange.

The attacks should convince companies to take a second, if not a third, look at their outsourced providers’ security, says Gartner’s Litan. While credit-card information comes with an industry mandated set of security standards, names and email addresses are not protected in the same way.

“We need a PCI equivalent outside the card space,” Litan says. “Until we have that, you really should think twice about it. More and more business are moving to the cloud now. The main concerns have been security and risk, and we now see these are valid concerns.