> series: anatomy_of_a_breach —— part: 153 —— target: epik —— data: 180GB —— exposed: whois_privacy_records —— attacker: anonymous<span class="cursor-blink">_</span>_
In September 2021, the hacktivist collective Anonymous breached Epik — a domain registrar and hosting provider — and published approximately 180GB of internal data. The dump contained the company's complete customer database, domain registration and transfer records, payment histories, login credentials (including API keys), internal emails, and system configurations spanning over a decade. Most significantly, the breach included WHOIS privacy protection data — the registration details of customers who had specifically paid Epik to keep their domain ownership private.
The breach was motivated by Epik's role as a hosting provider for websites that had been deplatformed by other providers — including sites associated with controversial and extremist content. Anonymous published the data with the stated aim of exposing the identities behind these websites. But the 180GB dump affected all of Epik's customers — not just those hosting controversial content — including individuals, small businesses, and organisations that had chosen Epik for legitimate purposes. The breach demonstrated that a domain registrar compromise exposes not just customer data but the ownership structure of every domain the registrar manages.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping CallThe Epik breach reinforced that infrastructure service providers — domain registrars, DNS providers, hosting companies — hold data and access that can compromise every customer simultaneously. For UK organisations, registrar account security (strong passwords, MFA, domain lock), DNS monitoring, and vendor security evaluation are essential controls. Cyber Essentials addresses infrastructure security. Our infrastructure testing assesses DNS and domain security. SOC in a Box monitors for DNS changes and domain compromise. And UK Cyber Defence provides incident response when domain infrastructure is targeted.
Our <a href="/penetration-testing/infrastructure">infrastructure testing</a> assesses domain and DNS security. <a href="/cyber-essentials">Cyber Essentials</a> mandates MFA. <a href="https://www.socinabox.co.uk">SOC in a Box</a> monitors DNS changes.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping Call