Spammers Will be Phishing for Your Money

During the last couple of weeks it’s likely that you have received a similar email notifying you that your email address was stolen. Epsilon, one of the largest email marketing companies, had its database breached and “a subset of Epsilon clients’ customer data were exposed.” According to Epsilon, the breach was limited to email addresses and/or customer names only. No other personal identifiable information was stolen.

The scope of the breach and the list of large customers involved, make this one of the largest security breaches of its kind. While only about 50 clients were involved they include some of the largest companies such as Citigroup, Capital One, Walgreen, Best Buy, Target, Hilton, Kroger, Tivo, US Bank, Disney, The College Board, and Marriott.

Even though the breach only included email addresses and names, many security experts are concerned about the implications. Simply knowing someone’s email address and their spending habits — or at least the brands with which they have some sort of relationship — may make it easy to craft a targeted and sophisticated phishing attack.

If scammers know that you have a credit card with Capital One, for example, they may send emails asking you to log into a website and provide personal information that will give them access to more data, including financial information. People do fall for these targeted “spear-phishing” attacks, because they appear to come from a company they have a relationship with.

Phishing Prevention 

Phishing attacks are not uncommon, but, if you keep your guard up about where you click and what information you enter into a website, you’ll probably be safe. But phishing attacks do work, even if it’s just for a small percentage of recipients. And as the breach at Epsilon has exposed tens of millions of email addresses, even that small percentage could prove to be a sizable number.

When you receive an email from any company you have a relationship with, make sure you scrutinize it fully. Look at the email address and verify the sender. Look for typos and strange URLs. But don’t click on those links.

If you do get a suspicious email — particularly one with an urgent tone asking you to update your personal information — pick up the phone and call the company in question. Remember: very few (if any) companies will ask you for sensitive information via email. If in doubt, log into the company website directly and verify the request.

To-do: Any client that maintains customer information is at risk. Make sure you talk with them about the risk they face and offer to provide a quote for Network Security and Privacy Insurance. You’ll help them and protect yourself from an E&O claim.

Note: You have my permission to copy, edit and reproduce this email for your own purposes. I recommend you send a similar email to your current clients alerting them to this issue.