alert Epik Had A Major Breach

[DaveX]

Just read this. Looks like Epik may have been hacked and sensitive data compromised...

Read here:
https://domainnamewire.com/2021/09/14/hackers-claim-significant-epik-breach/

Thought I would share this.

 

[Name Trader]

Yes, it was emailed out to any of their millions of customers whose data was involved in the breach.

Brad

Was that all 10 customers, Brad?

 

[bmugford]

Was that all 10 customers, Brad?

I think Credit Karma has 100M+ customers. It would have gone out to any of those customers who had emails involved in the data breach.

HaveIBeenPwned.com shows -

Compromised accounts: 15,003,961

There is going to be a lot of overlap between the two groups.

Brad

 

[Name Trader]

I think Credit Karma has 100M+ customers. It would have gone out to any of those customers who had emails involved in the data breach.

HaveIBeenPwned.com shows -

Compromised accounts: 15,003,961

There is going to be a lot of overlap between the two groups.

Brad

Yep It truely horrifying. Even Epik are tightening up the security ridiculously. A week ago they were releasing the registration locks on domains on day 60. Day 60 hasn't changed, but of course they are now releasing them on day 62, without any announcement to the world. Plus. For a while now (I'm not sure if this is a new feature) if you want to have the transfer out expedited, you have provide your PIN number. No problem with that. But again in the last week they now want to specify both the PIN AND the EMAIL address in your account, even though all my communications use this address 100% of the time. So they don't mind receiving instruction using my email address, but they want you to quote my PIN (no problem) AND my email address in my email BEFORE they will expedite the transfer. ABSOLUTELY RIDICULOUS.

I only started using EPIK recently, for drop catching. I transfer out in 62 (ahem) days. But they have gone MAD with expecting me to quote my email address in my email, else they won't expedite the transfer.

I've still got about 30 domains in Epik. But they will be gone when this 62nd day arrives. Which was always my plan anyway. Nobody should tolerate insanity on this scale.

Sorry for boiling over. But this is RIDICULOUS.

 

[dirk]

Day 60 hasn't changed, but of course they are now releasing them on day 62

If that's the case I predicts a lot of incoming ICANN complaints.

 

[Name Trader]

If that's the case I predicts a lot of incoming ICANN complaints.

They have certainly moved the date from 60 days to approx 2 days more. They haven't explained why. There could be a valid reason. But for the previous month I was transferring them out on the date in their control panel, and I'm not the only one surprised about this. But now we have to wait approx 2 extra days to do it. They are also making it harder to expedite the transfer. I'm sure before, they just accepted a request to to expedite that transfer. Then that needed the pin code. OK. But now they want you to quote the pin code and the account email address, in an email coming from that email address. This is just to expedite a transfer. After the experiment I'm currently conducting, I'm going to probably just transfer the existing domains out, and not use them any more. Stupid twits.

 

[dirk]

They have certainly moved the date from 60 days to approx 2 days more. They haven't explained why. There could be a valid reason. But for the previous month I was transferring them out on the date in their control panel, and I'm not the only one surprised about this. But now we have to wait approx 2 extra days to do it. They are also making it harder to expedite the transfer. I'm sure before, they just accepted a request to to expedite that transfer. Then that needed the pin code. OK. But now they want you to quote the pin code and the account email address, in an email coming from that email address. This is just to expedite a transfer. After the experiment I'm currently conducting, I'm going to probably just transfer the existing domains out, and not use them any more. Stupid twits.

Thanks. I can understand given the recent hack they make it a bit harder to transfer out domains. Could be annoying to some but nothing a quick email or support chat wouldn't resolve.

The additional days they've put on locks is ridiculous and serves no purpose. There's ICANN regulation regarding this for a reason.

Thanks for that info.

 

[DN Playbook]

Thanks. I can understand given the recent hack they make it a bit harder to transfer out domains. Could be annoying to some but nothing a quick email or support chat wouldn't resolve.

The additional days they've put on locks is ridiculous and serves no purpose. There's ICANN regulation regarding this for a reason.

Thanks for that info.

Indeed. Seems they are worried about a mass exodus. Lets see if they can fix the security hole. They were alerted to it as far back as February.

 

[Name Trader]

Well they've lost me as a customer, even before my experiment with SAV is over. BTW SAV won another domain today. SAV have won 3 out of 4 so far. So the trend is clear. So there are two domains left on my trial @DirkS, which drop in the next drop.

I don't have a problem with them asking for my PIN number, which is designed for this purpose. But I have a big problem asking for my email of my account, written in an email from that same email account which I correspond with them almost daily. That is too much to bear, writing that almost every day. It's not supports fault. They are just follow orders. They've gone from requesting expedited transfer, to requesting my PIN number (which I have no problem with) to requesting my PIN number AND my email address written down in the same email I'm sending to them. Just to expedite a transfer. Which used to take minutes, but now takes days (along with the 2 days they've added to the transfer process). They could just look at the email address and compare that with the email address on file instead of asking me to write the same email address down in the email address I'm writing from. And then just ask me if it doesn't match the email on file. It's probably less work for them.

 

[Derek Peterson]

Well they've lost me as a customer, even before my experiment with SAV is over. BTW SAV won another domain today. SAV have won 3 out of 4 so far. So the trend is clear. So there are two domains left on my trial @DirkS, which drop in the next drop.

I don't have a problem with them asking for my PIN number, which is designed for this purpose. But I have a big problem asking for my email of my account, written in an email from that same email account which I correspond with them almost daily. That is too much to bear, writing that almost every day. It's not supports fault. They are just follow orders. They've gone from requesting expedited transfer, to requesting my PIN number (which I have no problem with) to requesting my PIN number AND my email address written down in the same email I'm sending to them. Just to expedite a transfer. Which used to take minutes, but now takes days (along with the 2 days they've added to the transfer process). They could just look at the email address and compare that with the email address on file instead of asking me to write the same email address down in the email address I'm writing from. And then just ask me if it doesn't match the email on file. It's probably less work for them.

Imagine if a registrar had a website that was completely open to the world that anyone can see each and every transaction and hijack any account they desired. That's Epik.

They are probably doing everything manually and storing all data - usernames, passwords, pins, credit card details, etc written on spiral notebooks.

 

[Name Trader]

All this BS about making the checks more stringent on transfers away are completely misguided. They should be done at the front end not at the backend. IMHO.

 

[Derek Peterson]

All this BS about making the checks more stringent on transfers away are completely misguided. They should be done at the front end not at the backend. IMHO.

They know their servers are still wide open and now everyone else knows as well. They're probably just trying to protect from having domains stolen.

 

[HotKey]

Absolute proof of the biased mods here. Most of your posts are recycled trash that you've spewed ad nauseum. But I've made posts that go against you and the other creatures of habit in this thread and I get deleted because I'm not nice. Oh well. I'm glad I'm capable of an original thought at least. Let's see how long it takes the mods to delete this when you go crying to them

Completely agree on the recycled trash in this thread. Really the only thing I've gleaned is the hatred towards Rob Monster from users like @Derek Peterson , @Molly White and @bmugford based on.. ¯\_(ツ)_/¯

Hacks will be hacks there is never anything good that comes from them other than proof that there are losers with nothing better to do than, umm.. break and enter?

Most of the BS posted in this thread has nothing to do with a registrar hack, but a hatred towards a person and their beliefs. Even the person who wrote of the Wikipedia article for Epik even goes by the pseudonym "gorilla warfare", I mean how professional is that as a representative for the world's online encyclopedia?

These people have some sort of personal agendas, which I think shouldn't be totally discredited, but we all should be mindful of.

Epik was hacked, they won't be losing my business because of it just as any other company would. @Rob Monster has been an integral part of our domaining community for a long time, and I'm sure that I and countless others won't lose sight of that but rather support him and his company through this. The people that gave away our personal information were the one's in the wrong. Point blank.

The majority often doesn't have the time to commit to disproving online falsehoods, but rest assured, we are here and watching. I do appreciate the inputs by the likes of @Future Sensors that seem to be unbiased and geared towards the greater good in a security sense.

 

[Derek Peterson]

Completely agree on the recycled trash in this thread. Really the only thing I've gleaned is the hatred towards Rob Monster from users like @Derek Peterson , @Molly White and @bmugford based on.. ¯\_(ツ)_/¯

Hacks will be hacks there is never anything good that comes from them other than proof that there are losers with nothing better to do than, umm.. break and enter?

Most of the BS posted in this thread has nothing to do with a registrar hack, but a hatred towards a person and their beliefs. Even the person who wrote of the Wikipedia article for Epik even goes by the pseudonym "gorilla warfare", I mean how professional is that as a representative for the world's online encyclopedia?

These people have some sort of personal agendas, which I think shouldn't be totally discredited, but we all should be mindful of.

Epik was hacked, they won't be losing my business because of it just as any other company would. @Rob Monster has been an integral part of our domaining community for a long time, and I'm sure that I and countless others won't lose sight of that but rather support him and his company through this. The people that gave away our personal information were the one's in the wrong. Point blank.

The majority often doesn't have the time to commit to disproving online falsehoods, but rest assured, we are here and watching. I do appreciate the inputs by the likes of @Future Sensors that seem to be unbiased and geared towards the greater good in a security sense.

You are missing the point of the entire thread. I have never said hacks are good and I am certainly not a fan of the "hackers" but the issue at hand, HERE, is that Rob Monster LIED about his products and services. He claimed to have his own VPN, when in fact he was reselling another service, he claimed to be swiss bank of domain names when in fact he had not only never seen the code or had it reviewed he didn't even have access to it and his elite security team was storing full credit card details, un and weakly encrypted passwords, api login creds in code, etc etc. It is his dishonesty and deceit that allowed a hack of this magnitude to occur.

Nice try to deflect.

 

[bmugford]

Completely agree on the recycled trash in this thread. Really the only thing I've gleaned is the hatred towards Rob Monster from users like @Derek Peterson , @Molly White and @bmugford based on.. ¯\_(ツ)_/¯

The good thing is that facts don't care about bias.

Those facts are that "shitty Russian code" that was more than a decade old and terrible security protocols in general by Epik, lead to the breach that effected thousands of customers and the data of millions of total people.

Bias is irrelevant to those facts.

Brad

 

[Derek Peterson]

The good thing is that facts don't care about bias.

Those facts are that "shitty Russian code" that was more than a decade old and terrible security protocols in general, lead to the breach that effected thousands of customers and the data of millions of total people.

Bias is irrelevant to those facts.

Brad

It wasn't just incompetence tho, Monster LIED about his security and products. That is the real issue for me. And then when exposed by people for his lies, he tries to censor, defame and even threaten.

 

[DN Playbook]

Hacks will be hacks there is never anything good that comes from them other than proof that there are losers with nothing better to do than, umm.. break and enter?

Wow. Lots to unpack in your post. But lets start here. Not all hacks are the same. I am against hacking. However, in this case Epik was warned about their security hole back in February and did nothing. @Rob Monster continued in his narrative about and support of far-right extremist websites. His views are well documented here and elsewhere, I don't want to regurgitate them as it gives me nausea. This is dragging his customers and staff down with him. Not to mention he calls his staff whores, unless they pay their allegiance to Epik. I am not surprised that members of Anonymous targeted Epik because of Rob.

BTW, I am Canadian as well. I hope you don't want to go down this rabbit hole further.

 

[Derek Peterson]

Epik is a launching a new browser that will store all your login creds in one place. What could possibly go wrong.

 

[Windoms]

Completely agree on the recycled trash in this thread. Really the only thing I've gleaned is the hatred towards Rob Monster from users like @Derek Peterson , @Molly White and @bmugford based on.. ¯\_(ツ)_/¯

The fact that he was riding the dragon wielding a big shotgun shooting at industry stakeholders, claiming to be the fundamental most innovative and secure registrar in the world.

While lying.

With a $5.99 .com transfer candy bag.

Is not likeable.

Plus, they leaked the data.

(Because of nazi KKK friendship.)
(And leaving most secure doors wide open.)

 

[DN Playbook]

Epik is a launching a new browser that will store all your login creds in one place. What could possibly go wrong.

Never heard of that. Can you post the source?

 

[Derek Peterson]

Never heard of that. Can you post the source?

https://twitter.com/x/status/1459991204637155329

(I had to log out of Twitter because Mr Freeze Peach has me banned.)