alert Epik Had A Major Breach

[DaveX]

Just read this. Looks like Epik may have been hacked and sensitive data compromised...

Read here:
https://domainnamewire.com/2021/09/14/hackers-claim-significant-epik-breach/

Thought I would share this.

 

[Beezy]

He is going to set the investor money on fire trying to sue forum moderators. Absolute GOON of a CEO.

 

[bmugford]

If I have made any factual errors, you are free to offer evidence to the contrary.

I would offer the same to @Rob Monster. My opinions are my opinions.

If I have made any factual errors in posting, please feel free to point them out and I will be happy to correct them.

Thanks,
Brad

 

[Beezy]

You didn't make any factual errors, you made fun of the fact that he put a curse on the data too many times.

 

[bmugford]

You didn't make any factual errors, you made fun of the fact that he put a curse on the data too many times.

 

[bmugford]

The first law of holes, or the law of holes, is an adage which states: "if you find yourself in a hole, stop digging". Digging a hole makes it deeper and therefore harder to get out of, which is used as a metaphor that when in an untenable position, it is best to stop making the situation worse.

 

[Future Sensors]

An important part of this discussion thread started with responses to Rob Monster's hour-long video meeting at a time when there was an urgent need for clarification on this forum. Rob indicated in this video meeting that his lawyer had advised him against doing so, but that he nevertheless went ahead with it. Almost all authoritative media have written extensively about the incidents and these media reports are reflected in this thread. Have all these media also received a letter? At key moments, Rob Monster's input was explicitly requested to give him the opportunity to tell his side of the story. I'm surprised that such a message is now being addressed to namePros.

https://blog.mollywhite.net/monster-qa/

 

[bmugford]

An important part of this discussion thread started with responses to Rob Monster's hour-long video meeting at a time when there was an urgent need for clarification on this forum. Rob indicated in this video meeting that his lawyer had advised him against doing so, but that he nevertheless went ahead with it. Almost all authoritative media have written extensively about the incidents and these media reports are reflected in this thread. Have all these media also received a letter? At key moments, Rob Monster's input was explicitly requested to give him the opportunity to tell his side of the story. I'm surprised that such a message is now being addressed to namePros.

https://blog.mollywhite.net/monster-qa/

It probably won't be long until this letter from Rob is being shared on Twitter.

You take time out of your day to send a letter like this, but not issue a further update on the data breach itself? It is a really bad look IMO.

Brad

 

[DN Playbook]

@Rob Monster, your hypocrisy is quite demonstrative. You have damned yourself by attacking perceived competitors to lure their customers to your business (without provocation), you have courted openly and given safe haven to those that declare their hatred for marginalized groups, you have spread unsupported conspiracy theories in support of those who mass murder, you have threatened individuals on this forum. To invoke God as often as you do will not give you his protection. A loving God does not look too kindly on such behavior.

 

[Kenny]

So, why am I telling you this? Because the choices you are making will have consequences.

Doesn't sound veiled at all.

The first law of holes, or the law of holes, is an adage which states: "if you find yourself in a hole, stop digging". Digging a hole makes it deeper and therefore harder to get out of, which is used as a metaphor that when in an untenable position, it is best to stop making the situation worse.

And the Golden Shovel Award goes to...
May I have the envelope please.....

Peace,
Kenny

 

[Paul]

You didn't make any factual errors, you made fun of the fact that he put a curse on the data too many times.

I'm fairly certain I haven't even done that. I've been sticking to facts and analyses that are pertinent to domainers. It's normal for people who find themselves in Rob's situation to make statements that aren't ideal. There are plenty of other people pointing it out to him; there's no reason for me to join that crowd.

What I will not tolerate are vague threats toward people attempting to respond to the situation as best they can with the information at hand and assist others in doing the same. That is blatantly detrimental to his customers.

 

[tonyk2000]

Unlike most of us (myself including), @Paul is selecting what to write or recommend extremely carefully. His opinions are unbiased:

It's entirely possible that nothing will happen.

It is what one should expect from a security professional.

Thank you Paul.

It is possible that there is a good number of incorrect suggestions or allegations inside this 80+ pages thread. It is up to Epik to step in and provide an update, including explanation as to "who did it, how they did it, and when they did it".

 

[bmugford]

I'm fairly certain I haven't even done that. I've been sticking to facts and analyses that are pertinent to domainers. It's normal for people who find themselves in Rob's situation to make statements that aren't ideal. There are plenty of other people pointing it out to him; there's no reason for me to join that crowd.

What I will not tolerate are vague threats toward people attempting to respond to the situation as best they can with the information at hand and assist others in doing the same. That is blatantly detrimental to his customers.

I find it rather ironic for a supposed "free speech" champion to send such a letter.

What is the point exactly? It sure seems like it would be to shut down dissent via the implied threat of legal action.

Anything I have posted has been in good faith, with the information I have available at the time. Again, if you bring evidence to me that something I posted is factually incorrect, I would be more than happy to fix it.

Also, the news of this has been spread far more on Twitter than NamePros. On Twitter it can be worse as many people simply don't understand how the domain world works and can make false connections. I wonder if Twitter got the same letter?

Brad

 

[Paul]

I wasn't going to post the reply I sent, but Rob responded, and in the interest of ensuring I don't misrepresent him, I'll be editing the original post to include my reply and his response.

 

[bmugford]

I wasn't going to post the reply I sent, but Rob responded, and in the interest of ensuring I don't misrepresent him, I'll be editing the original post to include my reply and his response.

Paul,

This was not a legal letter. Perhaps you have decided to make it one but please know that the note I wrote was written to your eternal soul.

Regards,
Rob

The letter ends with the following... How is it not a legal letter?

So, why am I telling you this? Because the choices you are making will have consequences.

Epik will not perish. Our compliance team is following best practices. Our insurance coverage is ample. Our team is solid. Our domains under management continues to grow. And lastly, and most importantly, because God is on the throne.

My encouragement to you is to view your current actions and choices through an eternal lens. If souls are eternal, as I am quite sure they are, then even a $1 million “Epik Fail” bounty would not be worth it if it factored materially in your eternal path.

Finally, as I believe there are many folks who are likely damning themselves with false testimony, I would encourage a time slot that allows forum thread commenters the opporunity to go back and redact any false testimony before it is memorialized for consequence.

Regards,
Rob

I am pretty sure any reasonable person would come to the same conclusion about what is being implied / directly said there.

CC:YourEternalSoul

Brad

 

[oldtimer]

That means you have to trust one of two entities:

1. Epik
2. The hackers

If you are unable or unwilling to trust both of those entities, then you should assess the risk to your domains at Epik as being quite high even after you have rotated your passwords and other security information.

As a security professional you should know better to make such a general statement.

We don’t need to make everyone panic and become overly anxious about their domains needlessly for the fact that as you are aware when it comes to domainers perhaps less than 5 percent of the domains in most portfolios are of such value and quality that might require the level of security that you like to see.

The majority of the domains in any given portfolio are of average value and quality which really no one (not even the hackers) is going to go through the trouble to take.

Most of the whales* who were attracted to Epik for their special prices probably have had better arrangements for their ultra premium domains because one has to be a fool to transfer around those kind of domains to save a few dollars on renewals. (* Whales are those with very large portfolios).

As far as the innocent business clients go who have a domain or two that they use for their websites it seems that the hackers have taken some precautions to keep those people safe and anyone else who might gain access to their info is probably is not going to mess with them as interfering with other people’s business is a major crime.

So that leaves only the fringe and extremist groups who most likely will still continue using Epik either because of their loyalties or the fact that they have no where else to go.

So In my opinion domainers should not worry as much about losing their domains because the majority of those domains are not worth the trouble for anyone to try to take. Although it’s probably a good idea for everyone to increase the level of security for the few super premium domains that they might have and not to move them around every time there is a special on renewals at some registrars.

So it seems that most people should worry more about losing their personal info than losing any domains.

This hack (rightfully or wrongfully *) has been more about exposing information regarding some of the far right groups rather than trying to take anyone’s domains.

* The only way that the hackers can justify their actions as being hacktivists is if they also expose some of the shortcomings and injustices in the far left, otherwise they are just being used as political tools and pawns by those who want to bring down their opposition in any which way that they can.

Disclaimer: I am not associated or affiliated with anyone. These are my opinions as a neutral and impartial observer.

IMO

 

[bmugford]

As a security professional you should know better to make such a general statement.

We don’t need to make everyone panic and become overly anxious about their domains needlessly for the fact that as you are aware when it comes to domainers perhaps less than 5 percent of the domains in most portfolios are of such value and quality that might require the level of security that you like to see.

The majority of the domains in any given portfolio are of average value and quality which really no one (not even the hackers) is going to go through the trouble to take.

I don't really need to go on from there. I don't think you really understand the magnitude of this data breach.

From all reports it is almost an unprecedented event. Security and IT experts have discussed the terrible security protocols and measures being employed by Epik.

Rob takes time to send that letter to Paul, but issues no further update on the data breach which he said the following about in the same letter -

The hack incident is relatively understood. We know who did it, how they did it, and when they did it. We also have a pretty good idea of why they did it and for whose benefit

Brad

 

[bmugford]

So In my opinion domainers should not worry as much about losing their domains because the majority of those domains are not worth the trouble for anyone to try to take.

That is a pretty fucked up take in my view.

It is their property regardless of perceived value.

Brad

 

[Future Sensors]

Rob takes time to send that letter to Paul, but issues no further update on the data breach which he said the following about in the same letter

That's disturbing.

Epik really likes to use this forum for their business goals, always. The other forum that Rob talks about hardly criticizes Epik. In fact, hardly anything is said about this incident. It's a quiet place, but with a lot of freedom.

Rob to WIPO:

"However, if we lose this complaint, we will take care to critique the outcome in the public theater."​

"Thanks -- they were absolutely warned. The topic of WIPO overreach desperately needs to be exposed and they gave me a license to do exactly that. I literally told them: Here's a trap. I recommend you not step in it. If you step in it, we'll share it with the world."​

Source: https://www.namepros.com/threads/bc30-com-udrp-lost-by-namepros-member.1177875/#post-7642578
Source: https://www.namepros.com/threads/bc30-com-udrp-lost-by-namepros-member.1177875/#post-7642727​

Robert Davis (SVP of Strategy and Communications) to PayPal:

"As a clear public measurement, Epik was recognized in March as the worldwide “2020 Registrar of the Year”, outpolling GoDaddy nearly 2:1 in a survey of over 900 domain industry professionals and technology peers."​

Source: https://www.epik.com/blog/wp-content/uploads/2020/10/Letter-to-PayPal-CEO-Dan-Schulman.pdf
​

Epik website:

"Epik recognized as Best registrar worldwide in the NamePros 2020 Annual Industry Vote."​

Source: www.epik.com, frontpage.​

 

[bmugford]

"Epik recognized as Best registrar worldwide in the NamePros 2020 Annual Industry Vote."​

Source: www.epik.com, frontpage.​

They sure like flogging that in marketing.

The poll where they beat Dynadot by less than the margin of Epik employees on NamePros?
https://www.namepros.com/threads/do...gistrar-in-the-business-2020-edition.1179681/

Something must have happened between that poll in March, and the end of the year poll -
https://www.namepros.com/threads/best-favorite-registrar-end-of-year-poll.1219904

Dynadot won handily in that poll.

Brad

 

[HotKey]

Nine words we need to hear here:

We screwed up,
and are going to fix this.

Taking ownership, regardless of the intent of the breach and the backlash thereof. A solid customer base + assurances to restore order, even if it means rebuilding from the ground up, can ensure continuity in the face of chaos. Proclaiming accolades during this is actually detrimental. Pride has to take a backseat to repair.