Anatomy of a Breach

Anatomy of a Breach: Epik — 180GB of Domain Registrar Data Including WHOIS Privacy Records

> series: anatomy_of_a_breach —— part: 153 —— target: epik —— data: 180GB —— exposed: whois_privacy_records —— attacker: anonymous<span class="cursor-blink">_</span>_

Hedgehog Security 30 September 2021 12 min read

180GB of data. Every customer. Every domain. Including the ones paying for privacy.

In September 2021, the hacktivist collective Anonymous breached Epik — a domain registrar and hosting provider — and published approximately 180GB of internal data. The dump contained the company's complete customer database, domain registration and transfer records, payment histories, login credentials (including API keys), internal emails, and system configurations spanning over a decade. Most significantly, the breach included WHOIS privacy protection data — the registration details of customers who had specifically paid Epik to keep their domain ownership private.

The breach was motivated by Epik's role as a hosting provider for websites that had been deplatformed by other providers — including sites associated with controversial and extremist content. Anonymous published the data with the stated aim of exposing the identities behind these websites. But the 180GB dump affected all of Epik's customers — not just those hosting controversial content — including individuals, small businesses, and organisations that had chosen Epik for legitimate purposes. The breach demonstrated that a domain registrar compromise exposes not just customer data but the ownership structure of every domain the registrar manages.


Recommended

Not sure where to start?

We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.

Free Scoping Call

The privacy service became the privacy vulnerability.

WHOIS Privacy Defeated
Customers who paid for WHOIS privacy protection trusted Epik to keep their registration details confidential. The breach exposed all of that data — defeating the very service customers had paid for. When selecting privacy and security services, the provider's own security posture determines whether the privacy promise can be kept. Our <a href="/penetration-testing/infrastructure">infrastructure testing</a> assesses provider security.
Decade of Data in One Dump
The 180GB dump contained over a decade of records — highlighting the risk of long-term data retention without adequate security. <a href="/cyber-essentials">Cyber Essentials</a> and GDPR both require data minimisation — retaining only what is needed for current purposes.
API Keys and Credentials Exposed
The breach included API keys and login credentials — enabling further attacks against Epik's systems and potentially against customers' domains (through DNS hijacking or domain transfers). <a href="https://www.socinabox.co.uk">SOC in a Box</a> monitors for credential exposure and DNS change anomalies.
Registrar Compromise = Domain Compromise
A domain registrar controls DNS records, domain transfers, and WHOIS data for every domain it manages. Compromising the registrar provides leverage over all those domains. Our <a href="/penetration-testing/infrastructure">infrastructure testing</a> includes DNS security and registrar account protection assessment. <a href="https://www.cyber-defence.io/services/incident-response">UK Cyber Defence</a> provides incident response when domain infrastructure is compromised.

Your registrar holds your domain. Their security is your security.

The Epik breach reinforced that infrastructure service providers — domain registrars, DNS providers, hosting companies — hold data and access that can compromise every customer simultaneously. For UK organisations, registrar account security (strong passwords, MFA, domain lock), DNS monitoring, and vendor security evaluation are essential controls. Cyber Essentials addresses infrastructure security. Our infrastructure testing assesses DNS and domain security. SOC in a Box monitors for DNS changes and domain compromise. And UK Cyber Defence provides incident response when domain infrastructure is targeted.


Epik's breach exposed every customer's domain and privacy data. Is your registrar account secured?

Our <a href="/penetration-testing/infrastructure">infrastructure testing</a> assesses domain and DNS security. <a href="/cyber-essentials">Cyber Essentials</a> mandates MFA. <a href="https://www.socinabox.co.uk">SOC in a Box</a> monitors DNS changes.

Next Step

Not sure where to start?

We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.

Free Scoping Call

Related Articles