In September 2021, hackers identifying themselves as Anonymous released roughly 180 gigabytes of Epik data, apparently exfiltrated in late February, followed by additional releases of about 300 gigabytes on September 29 and further material on October 4. The disclosures included approximately 15 million unique email addresses, WHOIS records, domain histories, 843,000 transactions, nearly one million invoices, internal emails, account credentials, SSH keys, API keys, and up to 38,000 credit-card numbers, according to Epik and reporting cited in the source. A Maine breach notice said 110,000 people were affected. Researchers found passwords protected with unsalted MD5 and some financial data stored in plaintext.
Epik hosted or registered domains for Gab, Parler, 8chan, the Oath Keepers, and the Proud Boys, making the leak a major map of relationships within the far-right online ecosystem. A security researcher said he had warned CEO Rob Monster in January 2021 about a vulnerability capable of arbitrary code execution; Monster told TechCrunch he had mistaken the report for spam. Epik initially said on September 13 that it was unaware of a breach, acknowledged the incident on September 17, and notified customers beginning September 19. The FBI declined to confirm an investigation. On March 25, 2025, Canadian authorities arrested Anonymous-linked figure Aubrey Cottle over allegations related to the breach; the U.S. Justice Department unsealed related charges two days later. Cottle's lawyers dispute the timing and allegations.
