alert Epik Had A Major Breach

Jurgen Wolf said:

Were total slowness and troubles there... with any changes for domains.
Not just login from.

BEFORE this thread.

Click to expand...

tonyk2000 said:

As a side note. The pdf mentions Epik-provided "hosting" of various websites the hackers do not like. I refreshed my memory and checked whois of a few domains of this nature (registered via epik). Would not post domains in this thread - it is indexed and may attract irrelevant comments from non-domaining community as the result. But, any domainer can generate such a list. From ~3 domains I remembered, ALL are using cloudflare dns servers and cloudflare IPs. So, epik serves as a registrar only. So, it is unclear what are the hackers speaking about? What real IPs, hosting companies, etc..? Just the non-private whois (how real would it really be?)... payment details maybe (should be anonymous like btc)... ?

Click to expand...

.X. said:

second from Anonymous as to rather it is truly anonymous that did the hack .

Click to expand...

OFFICIAL ANONYMOUS (not to be confused with 'Anonymous Official' grifters) PRESS RELEASE

Click to expand...

.X. said:

I looked all over the internet .. including Dark .. I have found nothing from Anonymous stating they coordinated and are responsible for the hack .. so until clarity comes from Rob Monster and Anonymous.. I will just monitor

Click to expand...

Paul said:

"Anonymous" isn't a cohesive entity or organization; it's just a term used by random attackers. The letter from the attacker even pokes fun at this fact. As such, there's no way you could "hear from Anonymous."

Click to expand...

Paul said:

@tonyk2000, I wouldn't read too much into the message written by the attacker.

Click to expand...

.X. said:

the hacker or hackers usually post a video .. if it’s an anonymous hacker .. maybe things have changed though .. who knows

Click to expand...

Paul said:

I've already explained this.

Click to expand...

Paul said:

It's never been like that. It's a common point of confusion.

It would be akin to a group of people who wear jeans. Anyone can join the group by simply wearing jeans. Who represents the group? Well, nobody, really; it's just an arbitrary collection of people who have decided they want to be part of that collection.

Attackers know this causes confusion and play it up.

Click to expand...

.X. said:

there was nothing of data release or any one flaunting responsibility for that attack ..at least not as of 3 am ..

Click to expand...

DirkS said:

Skipped the couple of hundred posts. Is it true they were hacked? Sorry for being lazy but if true I'd better start transferring instead of going through all posts.

Click to expand...

Paul said:

Of course, but incident response is a tricky beast. It's overwhelming at best. Even the most prepared teams have to prioritize and end up making decisions that don't necessarily look great in hindsight.

There's always a human element, and as someone who's had experience being paged at 4 AM while on vacation because some random person decided that would be a great time launch an attack, I certainly empathize with what they're going through right now. Again, that's not to say I condone the silence or their security practices, but it's a tough situation to be in.



Keep in mind the actual attack in the spotlight here wasn't a DDoS attack, and it's important not to conflate the two. Denial of Service is just that: users have trouble accessing a service. It doesn't mean data has been leaked. That's not what appears to have happened here.

When enough real people visit a website, it has the same effect as a DDoS attack. If a lot of people are trying to log in right now, it will be indiscernible from the users' perspective: the site will slow down and fail to function properly. That's not an attack; that's just a side effect of everyone panicking.

Click to expand...

Paul said:

The data is being distributed publicly--not on the dark web, but out in the open. There's a link to it in the PDF on DNW.



The snippets of data I've seen appear to indicate as much, but the dataset is quite large, so I don't think anyone can be certain at this point. Epik doesn't seem to have commented.

Click to expand...

equity78 said:

Paul thanks for chiming in glad I tagged you. What would the steps be in order from first to last if you were consulted here or owned Epik in it's entirety?

Click to expand...

.X. said:

there actually is a video made that posted on Twitter .. I am on my phone and can’t post it .. but it is common for Anonymous to post a video .. they did

Click to expand...

equity78 said:

What would the steps be in order from first to last if you were consulted here or owned Epik in it's entirety?

Click to expand...

1. It forces you to think about what you're doing instead of panicking.
2. It provides a record of your response. Optionally, it can be published live to reassure users that you're responding to the incident.
3. It ensures everyone responding is on the same page.
4. For long incidents, it allows you to hand off, which is important: tired, stressed incidence response teams make mistakes, so each individual on the team needs to be able to rest without fear of being paged.
5. It enables to you to learn from the incident after-the-fact.

.X. said:

I looked all over the internet .. including Dark .. I have found nothing from Anonymous stating they coordinated and are responsible for the hack .. so until clarity comes from Rob Monster and Anonymous.. I will just monitor

Click to expand...

bmugford said:

I just found this tweet. This was just reported as news yesterday, but the tweet is from (2) days ago.

https://twitter.com/x/status/1437517323775086594

Click to expand...

Paul said:

Companies are going to get hacked; that's just the way it is. While there are clearly security lapses visible in the data, that's no different from any other company. Maybe it was hacktivism, maybe it was a disgruntled customer, maybe it was just someone who thought it was fun--it doesn't really matter.

Click to expand...