Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The available official and primary sources confirm a 2011 breach of Epsilon’s email marketing platform, but they do not verify that Victoria’s Secret was affected or that it ended a relationship with Epsilon because of the incident. The headline’s claim remains unsubstantiated in the reviewed record.
What happened in the Epsilon breach?
The Office of the Australian Information Commissioner (OAIC) says an Epsilon employee’s workstation was infected with malware while the employee was working remotely. The attacker used the compromised workstation to capture credentials, then accessed Epsilon’s email marketing platform from February 21 to March 30, 2011. The OAIC’s investigation concerned Dell Australia, and it says the accessed information included email addresses and first and last names of customers of multiple companies, including some Dell Australia customers. OAIC investigation report, published June 1, 2012.
This was an incident involving an email services platform. It should not be confused with evidence that every Epsilon client’s systems or every customer record were affected. The information exposed varied by client.
Free tools Windows power users keep installed
One-click scans. No signup required.
Was Victoria’s Secret affected, and did it leave Epsilon?
The sources reviewed do not name Victoria’s Secret as a confirmed affected company, establish that it was an Epsilon client at the time, or show that it ended a relationship because of the breach. That claim should therefore be treated as unverified, not as a documented consequence of the incident.
#1 Best Overall
There is client-specific evidence for other companies. Target said on April 5, 2011, that marketing and promotional email addresses had been exposed through unauthorized access to its email service provider, Epsilon. Target also said Epsilon assured it that personally identifiable information such as names and credit card information had not been compromised. That is Target’s account of its own exposure, not a description of every client’s records. Target’s statement, April 5, 2011.
How many Epsilon clients were involved?
A 2011 congressional hearing document reported Epsilon’s preliminary estimate that approximately two percent of its total client base was involved. It also cited public reports of at least 50 affected clients. These were preliminary figures reported in congressional material, not definitive final totals; the reviewed sources do not establish a final count. 2011 congressional hearing document.
How did Epsilon and the regulator respond?
The OAIC says Epsilon contacted potentially affected clients, issued public notices on April 1 and April 6, 2011, opened an incident-response center, notified law enforcement, and provided information to consumers about phishing. The regulator later concluded that Epsilon acted swiftly to identify and contain the risk, investigate the incident, improve safeguards, and work with law enforcement. This is the OAIC’s assessment of the response. OAIC investigation report.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsOn June 29, 2011, Epsilon announced additional security measures for its platform, including IP whitelisting, two-factor authentication, and a security collaboration with Verizon. That announcement describes measures Epsilon said it was adding at the time; it does not by itself demonstrate their effectiveness or establish the platform’s current security arrangements. Epsilon announcement, June 29, 2011.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What should consumers do about Epsilon marketing emails?
Epsilon’s current consumer information distinguishes between its own marketing databases and the mailing lists maintained by its clients. Its opt-out applies to Epsilon’s databases, and it offers a separate deletion request. Epsilon says it does not own client email-list data and cannot remove a person from a client’s list. To stop a particular company’s marketing emails, use that company’s unsubscribe process or contact the company directly. Epsilon consumer information.
During the 2011 incident, the Oregon Department of Justice warned consumers to watch for scam messages referring to the breach. Its April 6, 2011 alert said that a notice that a name and email address may have been compromised did not require a follow-up action with the company. That was incident-specific guidance at the time, not current individualized security advice. Oregon DOJ alert, April 6, 2011.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
