Registrar says payment card information may have been compromised.

An anonymous group said it has hacked domain name registrar Epik and downloaded significant data.

Late Saturday night, domain name registrar Epik sent an email to customers confirming the hack that was widely reported last week. This comes after one official email communication from the company, as well as a few blog and Twitter responses and a multi-hour live online meeting that included arguments with a doxxing victim and an appearance by a neo-Nazi.

The email warns customers to take precautions and suggests that customers consider contacting their credit card companies to warn them that their credit card information may have been compromised. The full email is below:

Hello,

We are contacting you to notify you of an urgent security notice. Despite the extensive security practices we use to protect our platforms and customer information, we have confirmed an unauthorized intrusion into some of our domain-related systems.

We have mobilized the full force of multiple cyber security teams to assess the scope of this intrusion. We are taking aggressive action to completely secure and remediate all potentially affected systems, while complying with all applicable laws. As we work to confirm all related details, we are taking an approach toward maximum caution and urging customers to remain alert for any unusual activity they may observe regarding their information used for our services – this may include payment information including credit card numbers, registered names, usernames, emails, and passwords.

At this time, we have not confirmed that your card information has been compromised. As a precautionary measure, you may choose to contact any credit card companies that you used to transact with Epik and notify them of a potential data compromise to discuss your options with them directly. Should you observe any unauthorized activity, please document and report it immediately.

We are notifying you because we consider your privacy and security our single greatest priority. Our mission to provide legendary service to all customers remains unchanged. We appreciate your support as we work through the full resolution of this situation, and we will continue to provide you with ongoing updates as we learn more.

Thank you,

Epik Security Team

What customers and other registrars should do to protect themselves until we know more.

Hackers have infiltrated Epik.

Domain name registrar Epik was hacked this week, and the hackers published reams of data online.

A group saying it’s aligned with the hacker collective Anonymous posted a release about the hack earlier this week. It says that the reason for the attack is that Epik caters to the far-right and extremist websites. After Epik seemed to waffle on whether there was a hack, the hackers made it public on Epik’s website itself.

The hackers published the data dump online, and security researchers are starting to comb through the data to see what was leaked.

Various sources have confirmed that the data includes registrant details behind many of the domains registered at Epik using Whois privacy. Both The Daily Dot and The Record have spoken with people whose data was released and confirmed that they were the registrants of the corresponding domain names.

A security engineer told The Daily Dot that the data includes the auth codes required to transfer domains to another registrar. It’s unclear if this data is tied to individual domains. This same engineer told The Daily Dot that the data includes WordPress admin passwords that people could use to take over Epik customers’ websites; I’m surprised by this because I wasn’t aware that these passwords were stored in any way that could be tied to a host.

The net-net is that we don’t know the full extent of the damage yet, but it looks bad.

This gets to how both Epik customers and other domain registrars can protect themselves and domain registrants.

At this point, Epik customers should hope for the best but plan for the worst. They should work on the assumption that their passwords have been exposed. If you re-use passwords at other sites (which you shouldn’t), you should change them to something unique. For safety’s sake, Epik customers should also assume that people have what’s needed to initiate a registrar transfer. With this in mind, I recommend domain owners use a system that tracks domain changes. DomainIQ and DomainTools offer trackers for this.

I’ve heard from some people trying to delete their Epik accounts. I don’t think this will help at this point; the data is already leaked.

Registrars should keep their eyes open for unusual transfer-in requests from Epik. I imagine some Epik customers are transferring their domains right now, but registrars should monitor this to ensure they aren’t being stolen.