Breach Brings Scrutiny

A data breach at a little-known entity that affected companies from J.P. Morgan Chase & Co. to TiVo Inc. is shining a light on the outsourcing of email marketing campaigns, a practice that has grown steadily over the past decade as consumers become less responsive to commercial pitches.

Epsilon Data Management LLC, a division of Alliance Data Systems Corp., said last week that hackers had accessed names and email addresses in its systems. In the days that followed, more than 40 companies -- including J.P. Morgan Chase, TiVo and others -- have said that their customers were among the victims. The companies had hired Epsilon to manage marketing campaigns. When retailers such as Best Buy Co. and Target Corp. email promotions to customers, the likely buyers are often identified by and the messages are sent by firms such as Epsilon. Managing bulk mailings can be time-consuming and the technology to sort through customer information to come up with targeted promotions is often changing too quickly for businesses to do it on their own, experts say. Companies like Epsilon know not to send a promotion for a winter coat to someone who lives in Miami, for example, or an email boasting low rates for mortgage refinances to people who don't own their homes. "We may receive an email from the same retailer but they would be completely different," said Dave Frankland, an analyst at Forrester Research. "Managing that across millions of customers is really complex." In addition to coming up with pitches customers are more likely to respond to, third parties like Epsilon also help ensure that an email isn't caught in a spam filter. Normally, 20% of legitimate email never reaches an inbox, according to Return Path Inc., which helps its clients deliver emails. Epsilon works with the largest email providers like Yahoo Inc., Google Inc., and Microsoft Corp. to ensure that the messages it sends to people who have elected to receive them get through. Epsilon said it sends more than 40 billion emails a year and that it has over 2,500 customers. Epsilon's revenue increased 27% from a year ago to $180 million in the quarter ended Dec. 31, according to Alliance, which acquired Epsilon in 2004 for about $300 million. Epsilon said about 2% of its clients were affected by the breach.