Enjoy unlimited access to all forum features for FREE! Optional upgrade available for extra perks.
Domain summit 2024

news Was there a Hack/Data Breach at Epik?

Domain summit 2024

404

Level 4
Joined
Jul 6, 2021
Messages
130
Reaction score
59
Feedback: 0 / 0 / 0
Seems like they are beating a deadhorse but what do I know.

@404 is a great username!

Cheers. Couldn't find my old credentials so wanted something nice this time around :). Been following again for a while...

On subject, if this thread is your only source regarding this hack, do some proper research. The magnitude of it is highly underrated over here.
 

robmonster

Epik.com CEO
Legacy Exclusive Member
Joined
Aug 15, 2010
Messages
120
Reaction score
302
Feedback: 0 / 0 / 0
My relative silence in this thread should not be misunderstood for being indifference. I don't think it will come as a surprise that the normally hard-working Epik team was working particularly hard in recent weeks.

Although it is too early to declare victory, we are certainly making progress. Here is a recap of just some of the actions taken:

 Retained forensic investigation and technical security firm on a full-time basis;

 Retained data privacy and cybersecurity outside counsels to report and remediate the Incident;

 Implemented industry best practice for secure password vault;

 Worked with development teams to cycle all SSH keys multiple times and shut down other means of access to Epik systems;

 Implement bug bounty program (est. Oct 7, 2021);

 Daily coordinated work and efforts combining executive, legal, PR, and security team;

 Migrated all source code to new platform;

 Forced client password resets;

 Shut down all outside access endpoints into Epik’s systems;

 Removed all credit card information from live databases;

 Implemented an SSO where strongly encrypted passwords are not stored on Epik systems and authorization;

 Continued to expunge unnecessary personal information from systems and implement best practices;

 Explored SOC-2 Compliance options after Incident response in near-term;

 Notified clients who were impacted by the data Incident on several dates (Sept 18 and 20, 2021), secured critical systems and provided 2 years of credit monitoring to clients who had payment information included in the Incident;

 Timely notified State Attorneys General in relevant jurisdictions, where prescribed by applicable state data breach notification law;

 Worked with the FBI to help identify the threat actors and take appropriate legal action.

I do greatly appreciate the continued support of our loyal clients as we continue to deploy best practices across the board as we set the stage to be an even better version of Epik.

#BeEpik
 

amplify

Level 5
Legacy Exclusive Member
Joined
Sep 15, 2009
Messages
3,464
Reaction score
1,171
Feedback: 68 / 0 / 0
Thank you for responding, @robmonster. I hope that this puts the conspiracy theories to rest that DNForum is moderating any side of the conversation, when in fact, we welcome anyone's opinion to use as a possible option to reevaluate and possibly better ourselves.

#BeEpik #BeHeard #DNFourm
 

404

Level 4
Joined
Jul 6, 2021
Messages
130
Reaction score
59
Feedback: 0 / 0 / 0
On an off-topic note, I think that this can be used to show our newly Epik-funded update for utilizing forum tags in a more useful way—implementing hashtags that are united to forum tags.

This isn't the only project we've been working on. There are several more additions that are at the tail end of the pipeline.

Things can only get better from here. :)


I was going through the latest leaked data and noticed there is mention of a DNforum git repo...

Might be wise to tighten up security.
 

Neoget

Level 5
Joined
Jul 5, 2021
Messages
312
Reaction score
149
Feedback: 0 / 0 / 0
Only some people with 6th sense know how busy you were with the whole team, our thoughts and support are with you.

About security I was thinking what if there can be implemented a firewall on server side (?) with rate limiting, something similar as Wordfence for WP sites, when there are too many attempts from hackers that are searching for holes, when too many accesed links are detected to block them, I use also redirection plugin and redirect all non existend found links to existent pages, I even have a special page with allot of bad words which I redirect them to it.
 

accurate

Level 8
Legacy Exclusive Member
Joined
Sep 28, 2012
Messages
1,233
Reaction score
475
Feedback: 0 / 0 / 0
Only some people with 6th sense know how busy you were with the whole team, our thoughts and support are with you.

About security I was thinking what if there can be implemented a firewall on server side (?) with rate limiting, something similar as Wordfence for WP sites, when there are too many attempts from hackers that are searching for holes, when too many accesed links are detected to block them, I use also redirection plugin and redirect all non existend found links to existent pages, I even have a special page with allot of bad words which I redirect them to it.

You rate limit attempts from the same IP address?
 

amplify

Level 5
Legacy Exclusive Member
Joined
Sep 15, 2009
Messages
3,464
Reaction score
1,171
Feedback: 68 / 0 / 0
I was going through the latest leaked data and noticed there is mention of a DNforum git repo...
So you want an illegal copy of Xenforo? If that's what it contains.

If so, I'm sure they won't be too happy it's being used on another URL not authorized to run it. Better off finding a nulled version (and hoping it's not got some built-in exploits) than screaming to the creators of Xenforo that you're running an illegal copy of their software... they don't play too kindly either way I hear.

@robmonster finds it beneficial to white-label and support all of the add ons/development that we're doing to Xenforo anyway (like the #hashtags above for instance), so you might as well wait before putting up something that might be buggy and not even waste time trying to find an exploit in old software.
 

amplify

Level 5
Legacy Exclusive Member
Joined
Sep 15, 2009
Messages
3,464
Reaction score
1,171
Feedback: 68 / 0 / 0
@404 is a great username!
Indeed it is. I couldn't read his posts at first... ba dum tss (I'll see my way out) 😆
Cheers. Couldn't find my old credentials so wanted something nice this time around :). Been following again for a while...
Well, welcome back either way! If you need help recovering an old account and want access to it, I could surely help by PM.
 

404

Level 4
Joined
Jul 6, 2021
Messages
130
Reaction score
59
Feedback: 0 / 0 / 0
So you want an illegal copy of Xenforo? If that's what it contains.

If so, I'm sure they won't be too happy it's being used on another URL not authorized to run it. Better off finding a nulled version (and hoping it's not got some built-in exploits) than screaming to the creators of Xenforo that you're running an illegal copy of their software... they don't play too kindly either way I hear.

@robmonster finds it beneficial to white-label and support all of the add ons/development that we're doing to Xenforo anyway (like the #hashtags above for instance), so you might as well wait before putting up something that might be buggy and not even waste time trying to find an exploit in old software.

Nah, all good :). Just letting you know in case some credentials are somewhere out there. Better to be safe than sorry. Judging by what I see on various SM I can imagine DNF could be a potential target, just for the amusement of some.

Indeed it is. I couldn't read his posts at first... ba dum tss (I'll see my way out) 😆

Well, welcome back either way! If you need help recovering an old account and want access to it, I could surely help by PM.

Lol, and thanks for the offer but this one will do just fine.
 

sekkuhaydi

Level 1
Joined
Oct 9, 2021
Messages
18
Reaction score
1
Feedback: 0 / 0 / 0
Epik hire bad people, is that security problem too? Bad people have access to my info for bad purposes. I want trust people with access, I don't trust

This valid problem, don't delete my post again Since censorship:
 

accurate

Level 8
Legacy Exclusive Member
Joined
Sep 28, 2012
Messages
1,233
Reaction score
475
Feedback: 0 / 0 / 0
I have two different Epik accounts. I noticed on the one where I forgot to change my password I received this email. My main account I did not receive the below Required Password Reset email.

Even if you do not change your password you can still login. I did not get a prompt to change my password. I change it anyway out of caution and security.

Stay safe out there. It's a jungle.

Hello,

Out of an approach toward maximum caution, we have required Epik users to change their passwords following an unauthorized intrusion into some of our domain-related systems on or before September 13, 2021.
For those who have not manually reset their passwords — our security team has already done so for your protection. For customers who have already changed their passwords since September 13, 2021, no further action is needed at this time.
To create a new password, simply complete the process through the login portal, here.

We recommend creating a unique password that you have not previously used for your account(s). Once your password reset has been finalized, you will be able to access your account information and all services as normal.

For questions related to this password change, or to learn more about our security features, please contact Epik Customer Support.

Sincerely,
Epik Security Team
 

robmonster

Epik.com CEO
Legacy Exclusive Member
Joined
Aug 15, 2010
Messages
120
Reaction score
302
Feedback: 0 / 0 / 0
I have two different Epik accounts. I noticed on the one where I forgot to change my password I received this email. My main account I did not receive the below Required Password Reset email.
Even if you do not change your password you can still login. I did not get a prompt to change my password. I change it anyway out of caution and security.

Stay safe out there. It's a jungle.

This bulk operation was done for folks who had not done a password update since September 13. If you previously changed your password and had 2FA in operation, there was no forced password reset.
 

accurate

Level 8
Legacy Exclusive Member
Joined
Sep 28, 2012
Messages
1,233
Reaction score
475
Feedback: 0 / 0 / 0
I have two different Epik accounts. I noticed on the one where I forgot to change my password I received this email. My main account I did not receive the below Required Password Reset email.


This bulk operation was done for folks who had not done a password update since September 13. If you previously changed your password and had 2FA in operation, there was no forced password reset.

Thanks for sharing this Rob.
 

MapleDots

Level 5
Legacy Gold Member
Joined
Sep 27, 2011
Messages
275
Reaction score
274
Feedback: 0 / 0 / 0
I am holding 10 crazy valued 4L domains

Crazy valued 4 letters?

Unless they are a dictionary term I don't often see any crazy valued 4 letter domains. Most of them go for under 2k and the oddballs often sell in the 2-$400 dollar range.

Unless by crazy you mean undervalued?

I have a pronounceable 4 letter .com asking 7.5k and no takers.
At one time I had it at 2.5k and considering it is a very nice pronounceable that was a bargain.

Anyways, I decided to hold it until 7.5k was a sale so I am not sure what you mean by crazy value.
 

The Rule #1

Do not insult any other member. Be polite and do business. Thank you!

Sedo - it.com Premiums

IT.com

Premium Members

AucDom
UKBackorder
Be a Squirrel
MariaBuy

New Threads

Our Mods' Businesses

Free QR Code Generator by MerchArts
UrlPick.com

*the exceptional businesses of our esteemed moderators

Top Bottom