2021 Epik data breach

Data breach

Hackers identifying themselves as a part of Anonymous announced on September 13, 2021 that they had gained access to large quantities of Epik data, including domain purchase and transfer details, account credentials and logins, payment history, employee emails, and unidentified private keys. The hackers claimed they had obtained "a decade's worth of data", including all customer data and records for all domains ever hosted or registered through the company, and which included poorly encrypted passwords and other sensitive data stored in plaintext. The Distributed Denial of Secrets (DDoSecrets) organization announced later that day that they were working to curate the leaked data for public download, and said that it consisted of "180 gigabytes of user, registration, forwarding and other information".

Journalists and security researchers subsequently confirmed the veracity of the hack and the types of information that had been exposed. The data included in the leak appeared to have been exfiltrated in late February 2021. The leak was later confirmed to include approximately 15 million unique email addresses, which belonged both to customers and non-customers whose data had been scraped from WHOIS records. It also included 843,000 transactions from a period of over ten years, and almost one million invoices. An engineer performing an initial impact assessment for an Epik customer said that Epik's "entire primary database", which contained account usernames, passwords, SSH keys, and credit card numbers stored in plaintext, had also been compromised. Internal memos describing subpoenas and preservation requests were also found in the leaked data. Many of the data preservation requests appeared to be related to investigations following the January Capitol attack.

A security researcher speaking to TechCrunch said he had identified a security vulnerability with Epik in January, which he had reported to Rob Monster, Epik CEO, but which had not been acknowledged. The vulnerability would have allowed attackers to execute arbitrary code on Epik servers, and the researcher said he suspected the same vulnerability had been exploited by the Anonymous attackers. Monster told TechCrunch he had seen the report, but mistook it for spam.

On September 29, Anonymous released another 300 gigabytes of data including bootable disk images. According to a cybersecurity expert speaking to The Daily Dot, "Files are one thing, but a virtual machine disk image allows you to boot up the company's entire server on your own. We usually see breaches with database dumps, documents, configuration files, etc. In this case, we are talking about the entire server image, with all the programs and files required to host the application it is serving." The second leak included API keys and plaintext login credentials for Epik's systems, as well as for services including Coinbase, PayPal, and the company's Twitter account.

A third release on October 4 reportedly contained more bootable disk images, as well as documents belonging to the Texas Republican Party.

Company response

On September 13, the day the hacked data was released, Epik said in statements to news outlets that they were "not aware of any breach". When the company did not acknowledge the breach, the attackers vandalized Epik's support website. On September 15, the company sent an email to customers notifying them of "an alleged security incident".

Monster acknowledged the hack in a September 16 four hour public video conference on PrayerMeeting.com, which The Daily Dot described as "chaotic and bizarre", which Le Monde characterized as "possibly one of the strangest responses to a computer security incident in history", and which CNN described as being "like a late-night campfire chat, albeit with an element of the surreal." During the conference, Monster recited prayers to scare away demons, warned participants in the conference not to tamper with the hacked data due to it being "cursed", and spoke in friendly terms with neo-Nazi Andrew Auernheimer and a founder of Anonymous Aubrey Cottle. Also during the conference, Cottle denied carrying out the Epik data breach, but added that "I would never, ever, ever, ever admit to a federal crime in a space like this."

The company publicly confirmed the breach on September 17, and began emailing customers to inform them on September 19. Data breach monitoring service Have I Been Pwned? also began sending emails to all addresses that had been exposed on September 19.

Epik submitted a data-breach notice in the state of Maine, in which they reported that 110,000 people had been affected by the breach, and that financial account and credit card data had been exposed. In a statement to The Washington Post, an Epik spokesperson said that up to 38,000 credit card numbers had been leaked.

Monster later said of the hack that "It didn't kill us" and "It's gonna make us stronger."

Aftermath

The hack was described as "a Rosetta Stone to the far-right", allowing researchers and journalists to connect links between various far-right websites, groups, and individuals who were using Epik's services. DDoSecrets co-founder Emma Best said researchers had been describing the breach as "the Panama Papers of hate groups", and said that researchers would be "in for the long haul" with the amount of data that had been exposed. The Columbia Journalism Review similarly compared the data breach to the Panama Papers leak, stating "Like the Panama Papers, getting information out of the huge database and making sense of it is time-consuming, which may explain why coverage of the Epik hack lagged..." Data from the hack was used to show that Ali Alexander, a far-right activist and key figure in the "Stop the Steal" conspiracy theory campaign, had worked to hide his connections to more than 100 websites after the 2021 United States Capitol attack.

Reactions

Extremism researcher and computer scientist Megan Squire said of the hack, "It's massive. It may be the biggest domain-style leak I've seen and, as an extremism researcher, it's certainly the most interesting." Internet anthropologist Gabriella Coleman predicted the hack would force far-right groups to find security providers outside of the United States, and said that the hack had "confirmed a lot of the details of the far-right ecosystem". Cybersecurity analyst and online extremism researcher Emily Crose said that the breach would likely intensify existing paranoia among far-right groups, who already felt like they were being surveilled after the Capitol attack.

An engineer performing an initial impact assessment for an Epik client told The Daily Dot that "[Epik] are fully compromised end-to-end ... Maybe the worst I've ever seen in my 20-year career". Following the hack, The Washington Post reported that "Epik's security protocols have been the target of ridicule among researchers, who've marveled at the site's apparent failure to take basic security precautions". Epik had been storing passwords using unsalted MD5, making them easy to crack. Other sensitive data, including credit card information, was being stored in plaintext.

David Vladeck, a Georgetown law professor and the former head of the Federal Trade Commission's (FTC) consumer protection bureau, said, "Given Epik's boasts about security, and the scope of its web hosting, I would think it would be an FTC target, especially if the company was warned but failed to take protective action".

The Seattle branch of the Federal Bureau of Investigation (FBI) told CNN that they could neither confirm nor deny the existence of an investigation into the Epik data breach.

Other breaches

Two weeks after the initial release of data, hackers released data taken from the American far-right Oath Keepers militia. The hackers responsible for the Oath Keepers leak did not claim any connection to Anonymous or draw any connection to the Epik breach, though some journalists have speculated that the leak may have been related or made possible by information from the Epik data. The Oath Keepers data consists of about 3.8 gigabytes of email archives, chat logs, and a membership list. The data is also being disseminated by DDoSecrets, though the group restricted the list of members and files containing donor and finance information to journalists. The Oath Keepers had been a customer of Epik's since January 2021, when their website was taken offline after their hosting provider terminated service in the wake of the Capitol attack.

Prosecution

On March 25, 2025, Aubrey Cottle was arrested by Canadian authorities on charges sought in Canada related to the data breach. Two days later US Department of Justice unsealed charges alleging Cottle's connection to the data breach.

In April 2025, Cottle's Canadian attorney Riaz Sayani gave a statement about the case claiming that "[t]he timing of these charges is peculiar. The allegations against Mr. Cottle are almost four years old" and that Canadian authorities had likely been waiting until US administration changed. In the US, Cottle is represented by Tor Ekland, an attorney who is well-known for representing hackers and people affiliated with Anonymous.