Epik Domain Registrar Breach Exposes 15 Million Accounts and WHOIS Records
What Happened — In September 2021 the domain registrar and web‑hosting provider Epik suffered a data breach that released more than 15 million records. The leak included email addresses, names, phone numbers, physical addresses, purchase histories and passwords, as well as WHOIS information scraped from non‑customer domains.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of inadequate third‑party oversight when a service provider hosts politically sensitive sites.
- Highlights the need for continuous monitoring of vendor security posture and evidence of due‑diligence to satisfy audit requirements.
- Shows how a defensible audit trail of vendor risk assessments can reduce exposure to regulatory penalties for personal‑data loss.
Who Is Affected – Primarily customers of domain‑registration and web‑hosting services, but also any individuals whose WHOIS data were scraped (broad cross‑industry impact).
Recommended Actions
- Re‑evaluate your vendor risk management program: verify that registrars and hosting providers maintain robust access‑control and data‑protection practices.
- Collect and retain evidence of vendor security assessments (SOC 2, ISO 27001, etc.) to demonstrate due‑diligence in audits.
- Implement continuous monitoring of third‑party security alerts and breach notifications.
Technical Notes – The breach appears to have been driven by retaliation against Epik for hosting alt‑right sites; the exact attack vector was not disclosed. Exfiltrated data included both customer‑provided information and publicly scraped WHOIS records. Source: Have I Been Pwned – Epik breach