alert Epik Had A Major Breach

[Silentptnr]

Just read this. Looks like Epik may have been hacked and sensitive data compromised...

Read here:
https://domainnamewire.com/2021/09/14/hackers-claim-significant-epik-breach/

Thought I would share this.

 

[blockhead]

Will be interesting to learn more about a potential 2020 hack, and if it was something that should have been disclosed to customers.


Some pretty serious info in the leak is coming to light now

 

[bmugford]

I wonder how Visa, Mastercard, Amex, and other payment processors feel about this practice?


Panic! in the Discord
@discord__panic

Anyone know who to report Epik to for PCI compliance? They have unencrypted credit card numbers, billing addresses, and CVVs in their databases..

7:21 PM · Sep 17, 2021

 

[bmugford]

Very interesting...

I am also sure the DOJ and FBI will absolutely love information about their investigation and subpoenas being revealed in this data breach.

Brad

 

[Chris Hydrick]

https://twitter.com/x/status/1439676897592430593

..

 

[Chris Hydrick]

Very interesting...

I am also sure the DOJ and FBI will absolutely love information about their investigation and subpoenas being revealed in this data breach.

Brad

https://twitter.com/x/status/1361443144064143361

...

https://twitter.com/x/status/1438572554877382665

...

https://twitter.com/x/status/1438573018276667403

...

https://twitter.com/x/status/1438573169535762433

...

https://twitter.com/x/status/1438573169535762433

...

https://twitter.com/x/status/1438574212315234312

...

https://twitter.com/x/status/1438576570202005510

 

[bmugford]

https://twitter.com/x/status/1361443144064143361

...

https://twitter.com/x/status/1438576570202005510

Some absolutely bonkers stuff.

Brad

 

[eternaldomains]

This extreme incompetence is the last straw for me. I'm quite dependent on Epik because this is the only registrar I know of that has both crypto payouts and domain tasting, but it's pointless if it's going to burn like this. Got many new regs there so I'm stuck for a while.

Currently I'll be initiating Masterbucks withdrawals in small batches. Will let you all know if it's all successful or not.

 

[Chris Hydrick]

Some absolutely bonkers stuff.

Brad

https://twitter.com/x/status/1438608857887035394

 

[Chris Hydrick]

Very interesting...

I am also sure the DOJ and FBI will absolutely love information about their investigation and subpoenas being revealed in this data breach.

Brad

I searched epik + maga.host (thanks to the now deleted screenshot) and stumbled upon:

https://krebsonsecurity.com/2021/01/hamas-may-be-threat-to-8chan-qanon-online/

I don't quite understand the article or comprehend the below graph. I added highlights to the red dot sections, as Weev, Anonymize, BitMItigate, Maga.Host are all topics that's been brought up in this thread.

 

[jmcc]

I don't quite understand the article or comprehend the below graph.

It seems like a graph of websites hosted on various IP addresses. The article deals with problematic IP ranges and companies. US citizens and businesses are not legally allowed to trade with some designated organisations or individuals.

Regards...jmcc

 

[JordanH]

Seeing all this was having me transfer my domains out of epik today. Only to realise their website no longer loads.

 

[karmaco]

Is there some reason we can’t approve our own transfers?

 

[blockhead]

I think I remember it being said that you have to contact Epik support to approve the transfer-outs now.


Edit: quote added

I emailed EPIK support, and they replied with the following:

======================================================
For security reasons, domain transfer approval has been disabled.

If you may provide us your Epik Account PIN # as well as the 2 domains, we'll get this done for you.
=====================================================

So I provided the information they requested. Hope they can move the transfers along ASAP.

 

[JordanH]

I think I remember it being said that you have to contact Epik support to approve the transfer-outs now.

Seriously? That's shady.

 

[mr-x]

Really serious domainers use platforms like https://www.internetx.com/en/domains/become-a-reseller/

What are their prices?

 

[Chris Hydrick]

https://twitter.com/x/status/1439676897592430593

..

More context:

It looks like this Joey sleazeball had registered the .com version of Melissa's twitter handle, ClaudioReport.com, and then redirected it to his joey sleazeball site.

https://twitter.com/AnarchoDoggo/status/1438780628967694336/photo/2

 

[Jurgen Wolf]

What are their prices?

Individual prices.

 

[Jurgen Wolf]

Transfer will be approved/finished automatically on 6th day. It is pending at REGISTRY level...
Just start it and forget.

 

[Chris Hydrick]

My opinion on Monday we're going to see folks not showing up to work, as they know their employers are about to find out about their secret lives.

By Friday we're going to hear of actual firings with press releases, as businesses realize that employing terrorists is bad.

https://twitter.com/x/status/1439548447028244481

 

[karmaco]

Transfer will be approved/finished automatically on 6th day. It is pending at REGISTRY level...
Just start it and forget.

yes I am having a hell of a time transferring 4 names. No approve button, wrong auth codes etc. I can’t even believe they are making it harder for us not easier. I am on a chat with Amy and still no auto approval option available

 

[NYJimbo]

Great. I just registered 50+ domains in the past two weeks after thinking things were getting better over there. Fnck.

 

[Lox]

E: 15,003,961
Check if your email/phone: Haveibeenpwned.com

Regards

 

[bmugford]

E: 15,003,961
Check if your email/phone: Haveibeenpwned.com

Regards

Oh no — pwned!

Epik: In September 2021, the domain registrar and web host Epik suffered a significant data breach, allegedly in retaliation for hosting alt-right websites. The breach exposed a huge volume of data not just of Epik customers, but also scraped WHOIS records belonging to individuals and organisations who were not Epik customers. The data included over 15 million unique email addresses (including anonymised versions for domain privacy), names, phone numbers, physical addresses, purchases and passwords stored in various formats.

Compromised data: Email addresses, Names, Phone numbers, Physical addresses, Purchases

 

[Bravo Mod Team]

https://twitter.com/x/status/1439708848659464193

https://haveibeenpwned.com/PwnedWebsites#Epik

https://haveibeenpwned.com/

 

[Lox]

Oh no — pwned!

Epik: In September 2021, the domain registrar and web host Epik suffered a significant data breach, allegedly in retaliation for hosting alt-right websites. The breach exposed a huge volume of data not just of Epik customers, but also scraped WHOIS records belonging to individuals and organisations who were not Epik customers. The data included over 15 million unique email addresses (including anonymised versions for domain privacy), names, phone numbers, physical addresses, purchases and passwords stored in various formats.

Compromised data: Email addresses, Names, Phone numbers, Physical addresses, Purchases

For now, HIBPWNED indexed 15,003,961 ...