Epik has long been a favored Internet company of the far-right, giving domain services to QAnon theorists, Proud Boys, and other perpetrators of the Jan. 6 attack on the United States Capitol, allowing them to broadcast vile messages while remaining anonymous. Last week, however, that curtain was shattered when the hacking group Anonymous released more than 150 terabytes of previously secret data, including user names, passwords, and other identifying information of Epik’s clients, in a massive breach.
Researchers and political opponents have viewed the leak as a Rosetta stone for the far-right, assisting them in deciphering who has been doing what with whom for years. Since word of the hack leaked last week, first discoveries have poured out steadily on Twitter, often with the hashtag #epikfail, but experts examining the information say it will take months, if not years, to get through everything. “It’s enormous.” Megan Squire, a computer science professor at Elon University who researches right-wing extremism, said, “It may be the biggest domain-style breach I’ve seen, and it’s certainly the most interesting as an extremism researcher.” “It’s an embarrassment of riches,” she says emphatically.
Epik, situated in the Seattle suburb of Sammamish, has created a name for itself in the online world by providing vital Web services to sites that have come afoul of other corporations’ laws against hate speech, misinformation, and violent advocacy. Its customer roster includes a who’s who of sites that are renowned for allowing extreme content and have rejected by other organizations for failing to monitor what their members upload.
Epik also supports a network of sites dedicated to QAnon conspiracy theories and other radical views. According to news reports, Epik briefly hosted the neo-Nazi site Daily Stormer after acquiring a cybersecurity firm that had provided it with hosting services in 2019. However, Epik swiftly discontinued that arrangement. Epik also announced that it would no longer support 8chan after a short amount of time. Epik also offered service to the anti-abortion group Texas Right to Life earlier this month, whose website, ProLifeWhistleblower.com, was taken down by GoDaddy because it collected accusations about which medical practitioners might be breaking a state abortion prohibition.
According to an Epik attorney, the company discontinued collaborating with the site because it broke corporate policies prohibiting the collection of personal information. Although the digital tip line is no longer open, and the site now links to the group’s homepage, online records reveal Epik was still the site’s domain registrant as of last week.
Epik creator Robert Monster’s readiness to provide technical support to far-right online had made him a frequent target of anti-extremism activists, who chastised him for republishing the Christchurch gunman’s manifesto and live-streamed video of the massacre using Epik’s tools. According to screenshots of his tweets and Gab postings at the time, Monster also used the occasion to promote the files, claiming that they were now “essentially uncensorable.” According to Bloomberg News, Monster also encouraged Epik staff to watch the film, which he claimed would persuade them that it was a hoax.
Monster has justified his job as essential to maintaining an uncensored and free Internet, associating himself with conservative opponents who believe that prominent digital corporations such as Facebook, Twitter, Amazon, and YouTube have gone too far in policing information they deem objectionable. The monster did not respond to The Washington Post’s requests for comment. In an email to consumers two days after the breach was reported, he said the company had experienced an “alleged security incident” and encouraged users to report any “abnormal account activity.”
As word of the hack spread, Monster wrote, “You are in our prayers today.” “When situations emerge in which people may not be acting honorably, I pray for them.” What the enemy means for evil, I believe, God invariably twists into good. “May God’s blessings be upon you all.”
Epik’s security policies have been mocked by researchers since the incident, who have marveled at the site’s apparent failure to take fundamental security safeguards, such as routine encryption, which could have kept client data from becoming public. Years of website purchase records, internal corporate communications, and customer account credentials are among the files, indicating who runs some of the most popular far-right websites. Client names, home addresses, email addresses, phone numbers, and passwords are all written in plain text. The theft even exposed personal information from Epik’s Anonymize service, which allowed clients to hide their identities.
The Federal Trade Commission has investigated companies like Ashley Madison for failing to protect its clients’ confidential data from hackers, based on similar failures by other compromised organizations. Settlements imposed financial fines and more stringent privacy rules have resulted from FTC investigations. “Given Epik’s boasts about security and the scale of its Web hosting, I would expect it would be an FTC target,” said David Vladeck, a former chief of the FTC’s consumer protection department who is now at Georgetown University Law Center. “I would add that the FTC would be unconcerned by the content, whether right-wing or left-wing; the questions would be about the potential extent and impact of the breach, as well as any security assurances… the corporation may have made.”
