The Epik data breach occurred in September and October 2021, targeting the American domain registrar and web hosting company Epik. The breach exposed a wide range of information including personal information of customers, domain history and purchase records, credit card information, internal company emails, and records from the company's WHOIS privacy service. More than 15million unique email addresses were exposed, belonging to customers and to non-customers whose information had been scraped. The attackers responsible for the breach identified themselves as members of the hacktivist collective Anonymous. The attackers released an initial 180gigabyte dataset on September 13, 2021, though the data appeared to have been exfiltrated in late February of the same year. A second release, this time containing bootable disk images, was made on September 29. A third release on October 4 reportedly contained more bootable disk images and documents belonging to the Texas Republican Party, a customer of Epik's.
Epik is known for providing services to websites that host far-right, neo-Nazi, and other extremist content. Past and present Epik customers include Gab, Parler, 8chan, the Oath Keepers, and the Proud Boys. The hack was described as "a Rosetta Stone to the far-right" because it has allowed researchers and journalists to discover links between far-right websites, groups, and individuals. Distributed Denial of Secrets (DDoSecrets) co-founder Emma Best said researchers had been describing the breach as "the Panama Papers of hate groups".
Epik was subsequently criticized for lax data security practices, in particular failing to properly encrypt sensitive customer data.
Background
Anonymous is a decentralized international hacktivist collective that is widely known for its various cyber attacks against several governments and governmental institutions, corporations, and the Church of Scientology. Primarily active in the late 2000s and early 2010s, Anonymous' media profile diminished by 2018. The group re-emerged in 2020 to support the George Floyd protests and other causes.
In September 2021, Anonymous asked people to support "Operation Jane", an effort by the group to oppose the Texas Heartbeat Act, a six-week abortion ban that went into effect on September 1. On September 4, Epik had begun providing services to a "whistleblower" website run by the anti-abortion Texas Right to Life organization, which allowed people to anonymously report suspected violators of the bill. The website, which moved to Epik after being denied services by GoDaddy, went offline after Epik told the group they had violated their terms of service by collecting private information about third parties. On September 11, Anonymous hacked the website of the Republican Party of Texas, which is hosted by Epik, to replace it with text about Operation Jane.
Data breach
Hackers identifying themselves as a part of Anonymous announced on September 13, 2021 that they had gained access to large quantities of Epik data, including domain purchase and transfer details, account credentials and logins, payment history, employee emails, and unidentified private keys. The hackers claimed they had obtained "a decade's worth of data", including all customer data and records for all domains ever hosted or registered through the company, and which included poorly encrypted passwords and other sensitive data stored in plaintext. The Distributed Denial of Secrets (DDoSecrets) organization announced later that day that they were working to curate the leaked data for public download, and said that it consisted of "180gigabytes of user, registration, forwarding and other information".
Journalists and security researchers subsequently confirmed the veracity of the hack and the types of information that had been exposed. The data included in the leak appeared to have been exfiltrated in late February 2021. The leak was later confirmed to include approximately 15million unique email addresses, which belonged both to customers and non-customers whose data had been scraped from WHOIS records. It also included 843,000 transactions from a period of over ten years, and almost one million invoices. An engineer performing an initial impact assessment for an Epik customer said that Epik's "entire primary database", which contained account usernames, passwords, SSH keys, and credit card numbers stored in plaintext, had also been compromised. Internal memos describing subpoenas and preservation requests were also found in the leaked data. Many of the data preservation requests appeared to be related to investigations following the January Capitol attack.
