Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: Extreme Disclosure? Not yet but a great trend! - SANS Internet Storm Center SANS ISC InfoSec Forums

Participate: Learn more about our honeypot network

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Extreme Disclosure? Not yet but a great trend!


        There is a trend in vigilant disclosure by some companies and service providers. A reader wrote in with a great example of an email disclosure. U.S. Bank informed it's customers of a breach in a partners system. It went on to disclose that the partner system had been accessed by unauthorized users and that customer email addresses had been exposed.

         What stuck out for myself and other handlers that commented, was the way the disclosure was handled. U.S. Bank then clearly identified it's information disclosure policy. They followed on to inform customers that at no time was financial data disclosed and that only Epsilon's systems had been accessed.

         If you have had any disclosures from vendors please send them in to us. Packets are better but we take disclosures as well!


Below is the email that was relayed.

As a valued U.S. Bank customer, we want to make you aware of a situation that has occurred related to your email address.

We have been informed by Epsilon Interactive, a vendor based in Dallas, Texas, that files containing your email address were accessed by unauthorized entry into their computer system. Epsilon helps us send you emails about products and services that may be of interest to you.

We want to assure you that U.S. Bank has never provided Epsilon with financial information about you. For your security, however, we wanted to call this matter to your attention. We ask that you remain alert to any unusual or suspicious emails.

Please remember that U.S. Bank will never request information such as your personal ID, password, social security number, PIN or account number via email. For your safety, never share this or similar information in response to an email request at any time. To learn more about recognizing online fraud issues, visit:

In addition, if you receive any suspicious looking emails, please tell us immediately.

Call U.S. Bank Customer Service at 800-US-BANKS (800-872-2657).

The security of your information is important to us, and we apologize for any inconvenience this may have caused you. As always, if you have any questions, or need any additional information, please do not hesitate to contact us.



Thanks to all of those that sent in their notifications. On the list so far: 

Best Buy, Home Depot, Chase, U.S. Bank, Robert Half, Disney Destinations, Citibank, Hilton Honors.  No doubt there will be more to come. 



Epsilon in their press release mentions that only email addresses and names have been compromised for approximately 2 percent of their clients.  A quick calculation shows that is at least 50 organisations (over 2500 clients).  So a few more of you may be getting notifications.


Richard Porter

--- ISC Handler on Duty 

Can be reached:

Twitter: packetalien

Email: richard at isc dot sans dot edu



173 Posts
ISC Handler
Apr 3rd 2011 - search the home page for Epsilon

I got three disclosures this weekend alone because of the Epsilon breach, the same company US Bank used. First it was SilverPop last December, then Epsilon last week and there are some rumblings that the TripAdvisor email address breach, which I also got, may have been from a third company that hasn't disclosed yet.
At last check (7:00PM CST, 4/3/11) this was the whole list for this breach. Lots of data compiled from,,, and the Cincinnati Business Courier.

U.S. Bank
New York & Co.
JP Morgan Chase
McKinsey Quarterly
Capital One
City Market
Fred Meyer
Marriott Rewards
Ritz Carlton
Smith Brands
Home Shopping Network
Jay C
Food 4 Less
King Snoopers
Disney Destinations
I got a notification from Robert Half International, Inc. (, as well as one from USBank. RHI is an employment agency.
I'll forward it in.
Also, I had opted out of marketing emails from USBank, yet I was still in their marketing database :(
@BJ: It seems contradictory but they need to keep your email address in the database to know that you have opted out! Also, there are two kinds of opt-out: simple opt-out of marketing emails and full opt-out of all emails. With simple opt-out, they can override the opt-out for important news such as a product recall or data breach (as in this situation). With full opt-out, you will be placed on a "blacklist" that tells them never to send you emails under any circumstances. In both cases, however, they need to keep your email address on file so that they can do that check; if they remove it, they will not know that you have opted out.

35 Posts
Citibank is opting to place it's notification on the login page. Could be better. Chase has theirs behind a link on the main page. I used my bookmark to the login page, logged in, checked the message area, and logged out without seeing a mention of it. You have to look for it.
G.Scott H.

48 Posts
Would be nice to get Ben Wright's (instructor) opinion on the matter. Looks like some companies pulled the notification trigger quicker than others.
G.Scott H.
1 Posts
You can also add Best Buy Rewards Zone to the list.
G.Scott H.
2 Posts
@patermann, BJ
No they don't. that is the beauty of hashes. Like passwords, they can salt&hash your mailaddress, so they don't need to keep your info, but can still verify that you DO NOT want SPAM. Off course the spammers could do a bruteforce on it, but it would, at least, make their efforts more expensive and perhaps not worth it...

3 Posts
Just want to second nge's comment about hashes.
Hashes are your friend. Use them whenever possible.
11 Posts
I received emails from Disney Destinations and US BANK, and also from Best Buy, which is not on the list above. The wording is pretty much the same in all three emails, very similar to the example above. The Best Buy had a link to geeksquad article on how not to get hacked, which I thought kind of ironic.
2 Posts
I am a former customer of a few of those places (no longer have credit cards, etc. on purpose). I wonder how many people with former accounts were in those databases and are not notified?
5 Posts
@patermann, BJ & nqe
If they use a true opt-in* system, all they need to do to do when you opt-out is to delete your email address. There is no reason to maintain a list of people who have opted-out. If you want to opt back in later, you can log onto their site and submit your email address for inclusion.

* A system in which offers you a choice in-which the check mark is checked by default IS NOT opt-in!
7 Posts
Epsilon *had* (key word, past-tense) pulled the announcement of the data breach from their website earlier this morning. Between my registration and this post, they've apparently put the notice back up.

As an amusing aside, the error page that showed up in its absence dumped a .NET 2.0 stack trace right into my browser. Whoops.
1 Posts
Add Robert Half to the list. I used to consult through them, got an e-mail notification this AM.

2 Posts
Got one from Hilton HHonors as well.

17 Posts
Now covered on Slashdot:
28 Posts
Add, just got a notice about a half-hour ago.

Leg523 student, if you are current in Ben's class, you should be able to drop him an e-mail asking him a "scholarly question", but not "legal advise" as he advises in his materials. I'm taking that class as well in on demand, so it would be an interesting piece of feedback. Maybe I'll shoot him a note tonight.

57 Posts
I have been notified by The College Board, Target, RHI, and Best Buy.

2 Posts
@nqe: I take your point about hashes, although there is always the (admittedly very small) possibility of collisions.

@jwhitlow: One reason for a company to maintain a list of opted-out email addresses (rather than just deleting them) is for the situation where they have a "refer-a-friend" and/or "forward-to-a-friend" feature. (i.e. Do you have any friends who might like to receive this email? If so, enter their name and email address here...) If a "friend" (or enemy!) uses this feature and sends your email address to the company, the company can check the opted-out list and not send the email to you. If your email address has been deleted, you can find yourself back on the mailing list again because they will not know that you have opted out.

35 Posts

Sign Up for Free or Log In to start participating in the conversation!