Sophisticated Cyber Thieves Behind Epsilon Attack

WASHINGTON – An online marketing firm hit by what may be one of the biggest data thefts ever was the victim of "highly sophisticated cyber thieves," according to its parent company.

Alliance Data Systems Corp. also reiterated that only the names and email addresses of customers were stolen in the attack on its subsidiary, Epsilon, and not credit card information or social security numbers.

Alliance Data said Epsilon is investigating the "unauthorized entry" into its email system with federal authorities and outside forensics experts and implementing additional security protocols.

"We will leave no stone unturned and are dealing with this malicious act by highly sophisticated cyber thieves with the greatest sense of urgency," Alliance Data chief executive Ed Heffernan said in a statement.

"We fully recognize the impact this has had on our clients and their customers, and on behalf of the entire Alliance Data organization, we sincerely apologize," Heffernan said.

Major U.S. banks, hotels, retail outlets and other companies have been warning customers to be wary of fraudulent emails after Epsilon acknowledged last week that hackers had gained access to the Texas-based company's email system.

Epsilon, which sends out over 40 billion emails a year on behalf of 2,500 companies, has not identified the firms whose customers' names and email addresses were stolen but dozens of U.S. companies have come forward.

They include Hilton and Marriott hotels, telecom giant Verizon, drugstore chain Walgreens, the Home Shopping Network and retailers Best Buy, Kroger, New York & Co. and Target.

Among the banking and financial firms that have notified customers of the breach are Citigroup, JPMorgan Chase, Capital One, U.S. Bank, Barclays Bank of Delaware and Ameriprise Financial.

Computer security experts said tens of millions of names and email addresses may have been stolen in what they said was one of the largest data thefts in U.S. history.

Epsilon president Bryan Kennedy also issued an apology.

"We are extremely regretful that this incident has impacted a portion of Epsilon's clients and their customers," Kennedy said. "We take consumer privacy very seriously and work diligently to protect customer information.

"We apologize for the inconvenience that this matter has caused consumers and for the potential unsolicited emails that may occur as a result of this incident," he said.