Mass e-mail breach: Just how bad is it?

By David Goldman, staff writer


NEW YORK (CNNMoney) -- It seems like every day for the past week, another dozen major companies have come out and said that they too have been affected by the massive data breach at e-mail marketing firm Epsilon.

Verizon (VZ, Fortune 500), Ritz Carlton, JCrew, Ann Taylor (ANN) and Victoria's Secret were among the most recent companies to tell customers that their e-mail addresses had ended up in the wrong hands.

The strange thing is that Epsilon, which manages customer databases and e-mail marketing for about 2,500 companies, announced the breach on March 31 -- a week ago. So why are companies still coming out of the woodwork a week later?

"We wanted to make sure we had the most detailed information possible from Epsilon," a Verizon spokesman said of his company's decision to wait until late Tuesday to send a message to its customers about the data theft. "With such a sensitive topic as personal information security, we wanted to get the information exactly right."

"It was necessary to take some time to fully understand the extent of the issue," said a Ritz Carleton spokeswoman. "Once we knew how this impacted our customers, we carefully crafted the appropriate communication."

Several other companies that notified their customers in the past day or two declined to comment. Epsilon also declined to discuss the incident.

It's understandable that companies would want to be very clear about what exactly is at stake for their customers: "Massive data breach" sounds scary.

But this one is pretty limited in scope. Epsilon said last week that an "unauthorized entry into Epsilon's e-mail system" exposed e-mail addresses and some customer names from around 2% of its clients.

The main danger that poses is the potential of increased spam and phishing attacks.

Spam sucks, but it's the modern equivalent of junk mail -- an annoying, but mostly benign fact of life.

The more hazardous threat is an increase in phishing attacks. Those fraudulent e-mails try to draw in in unsuspecting consumers by posing as messages from their bank, credit card company or telecom provider.

Phishing e-mails tend to tell recipients that their accounts have been blocked, and that they need to enter their account information to unblock them. But it's not Citibank or Macy's collecting that account information -- it's cyber criminals.

To avoid phishing attacks, customers should know that companies almost never request personal information in e-mail form. Suspicious e-mails should simply be deleted.

Meanwhile, expect those "your e-mail address has been compromised" messages to keep coming.

The laundry list of companies whose customer lists have been attacked is still growing. Ameriprise Financial, Hilton, Marriott, Chase, Target, Bebe, Eddie Bauer, TiVo, New York & Co., The McKinsey Quarterly, Lacoste, 1800-Flowers, Barclay's Financial, Best Buy, Walgreens, TD Waterhouse, Soccer.com, Beachbody, College Board, Citi, Brookstone, and AT&T Universal Citi Card have all reported that they were affected. To top of page

Frontline troops push for solar energy
The U.S. Marines are testing renewable energy technologies like solar to reduce costs and casualties associated with fossil fuels. Play
25 Best Places to find rich singles
Looking for Mr. or Ms. Moneybags? Hunt down the perfect mate in these wealthy cities, which are brimming with unattached professionals. More
Fun festivals: Twins to mustard to pirates!
You'll see double in Twinsburg, Ohio, and Ketchup lovers should beware in Middleton, WI. Here's some of the best and strangest town festivals. Play
Index Last Change % Change
Dow 17,672.60 -141.38 -0.79%
Nasdaq 4,757.88 7.48 0.16%
S&P 500 2,051.82 -11.33 -0.55%
Treasuries 1.82 -0.08 -4.17%
Data as of 8:30am ET
Company Price Change % Change
Bank of America Corp... 15.73 -0.36 -2.24%
General Electric Co 24.48 0.20 0.82%
Apple Inc 112.98 0.58 0.52%
Avon Products Inc 7.98 -0.68 -7.85%
Intel Corp 36.44 -0.46 -1.26%
Data as of Jan 23

Sections

Investors get to check Corporate America's pulse as over 140 S&P 500 companies report earnings this week. More

The National Hockey League is partnering with GoPro to get hockey fans closer to the action than ever before. More

Hershey has forced an importer to stop selling proper British chocolates in the United States, angering fans of Cadbury and Toffee Crisps. More

Tax season is prime time for cons. Tax scammers are sending out so-called "phishing emails" that appear to be from the IRS and claim that the recipient either owes money or is due a refund. More

Most stock quote data provided by BATS. Market indices are shown in real time, except for the DJIA, which is delayed by two minutes. All times are ET. Disclaimer.

Morningstar: © 2015 Morningstar, Inc. All Rights Reserved.

Factset: FactSet Research Systems Inc. 2015. All rights reserved.

Chicago Mercantile Association: Certain market data is the property of Chicago Mercantile Exchange Inc. and its licensors. All rights reserved.

Dow Jones: The Dow Jones branded indices are proprietary to and are calculated, distributed and marketed by DJI Opco, a subsidiary of S&P Dow Jones Indices LLC and have been licensed for use to S&P Opco, LLC and CNN. Standard & Poor's and S&P are registered trademarks of Standard & Poor’s Financial Services LLC and Dow Jones is a registered trademark of Dow Jones Trademark Holdings LLC. All content of the Dow Jones branded indices © S&P Dow Jones Indices LLC 2015 and/or its affiliates.