Epik epik.com Epik data breach: what happened and what to do
In September 2021 the domain registrar Epik suffered a major breach exposing over 15 million email addresses, with names, phone numbers, physical addresses and purchases. It included people who were never Epik customers.
View all 13,115 breaches- Breach date
- 13 Sept 2021
- Affected
- 15,003,961
- Data exposed
- Email addresses, Names, Phone numbers, Physical addresses, Purchases
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
Epik is a domain registrar and web host. Have I Been Pwned (HIBP) lists a breach dated September 13, 2021 with 15,003,961 affected accounts, added six days later.
What happened
The attackers released a large dataset on September 13, 2021, and press coverage says it appeared to have been taken earlier in the year. Epik first said it knew of no breach. On September 18 it posted a notice confirming that customer account information had been accessed and downloaded.
What was exposed
HIBP lists email addresses and names. Phone numbers and physical addresses are in there too, along with purchases and passwords. Some of the email addresses are the anonymised ones used for domain privacy.
The unusual part is who was affected. The data also held scraped WHOIS records for people and organisations who weren't Epik customers. WHOIS is the public registry of who owns a domain, and anyone who registered a domain without privacy protection had a name, address, phone number and email in it. So you could be in this breach without ever using Epik.
What that means for you
A leaked domain owner record shows where you live. It ties your name to a website. Scammers can use that to write convincing messages about your domain, and stalkers can use it to find you.
What to do if you were in it
- 1
Turn on WHOIS privacy for your domains
If you own a domain, ask your registrar to hide your name, address and phone number in the public WHOIS record. Most offer this.
- 2
Change your password, and anywhere you reused it
Set a new password for Epik. If you used the same one anywhere else, change it there too, starting with email and banking. Use a password manager so every account gets its own.
- 3
Expect phishing that mentions this breach
Criminals use leaked names and emails to write convincing messages. Don't click links in unexpected emails or texts, and go to the company's site by typing the address yourself.
- 4
Watch for domain renewal scams
Messages claiming your domain is about to expire are a common scam. Check your domain's status in your registrar account directly.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It looks across breach databases and the dark web for your email and phone number and tells you what to do about each hit.
Frequently asked
Was I affected by the Epik breach?
If you were an Epik customer, yes, likely. People who owned a domain whose WHOIS record was scraped may also be in it. Search your email address on Have I Been Pwned.
What was exposed?
Email addresses, names, phone numbers, physical addresses, purchases and passwords in various formats.
How many people were affected?
HIBP lists 15,003,961 accounts.
Should I change my password?
Yes, if you had an Epik account, and on any site where you reused it.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
