Epik, a Washington state-based domain registrar known for hosting far-right and deplatformed websites, was breached by hacktivists affiliated with Anonymous as part of a campaign called Operation Jane, which protested Texas Senate Bill 8. Attackers exploited a server misconfiguration to exfiltrate approximately 180 gigabytes of data, later published through the transparency collective DDoSecrets. The leak was described as containing roughly a decade's worth of internal records. Approximately 15 million individuals were affected, including many who were never Epik customers, because the company had stored large volumes of scraped WHOIS registration data, centralizing contact details that were technically public but not intended to exist in a single, searchable trove. Exposed data included names, email addresses, phone numbers, physical addresses, domain purchase histories, and payment records. Researchers reviewing the leaked files reported finding full credit card numbers, unencrypted passwords, and CVV codes, the three- or four-digit card security numbers that payment industry rules strictly prohibit storing. For affected individuals, the risks extend beyond typical credential theft. Domain ownership records in the dump allow outside parties to map the operators of politically sensitive or extremist websites, creating potential for targeted harassment, doxxing, and retaliation. Anyone whose contact details appeared in Epik's WHOIS data, regardless of whether they knowingly used Epik, faces that exposure. Epik initially denied that any breach had occurred before eventually acknowledging an incident. CEO Rob Monster had reportedly received a warning about a critical security vulnerability months earlier but dismissed it as spam. No significant regulatory action against Epik was publicly confirmed following the breach. Affected individuals, particularly those who registered domains for sensitive or politically contentious projects, should treat their contact details as compromised and remain alert to phishing attempts, account takeover attacks, and targeted outreach from hostile actors.

Domain registrars and hosting providers collect registrant identity, contact data, billing records, domain ownership details, support tickets, and infrastructure-linked account information.

Following the 2021 hack, Epik acknowledged serious security deficiencies and attributed vulnerabilities to outdated code from a previous development team. Rob Monster, Epik's founder, stepped back from day-to-day operations in subsequent years. The company has maintained a lower public profile while continuing to provide domain and hosting services. Its associations with far-right and extremist content hosts have continued to generate periodic media attention.