2021 Publicis (Epsilon Data Management) — $150M U.S. deferred-prosecution resolution; DTC unit sold consumer data used in elder-fraud mailings (Jan)
Data compromised
Consumer marketing data sold into fraudulent mailing operations—scale described in millions of consumers in secondary press; no single victim census row
Technical writeup
Epsilon Data Management, LLC, a marketing-data business then under Publicis Groupe, entered a U.S. Department of Justice deferred-prosecution framework resolving a criminal information alleging a Direct-to-Consumer (DTC) unit sold consumer list data that clients used in fraudulent mass-mailing schemes disproportionately harming older adults. The DOJ Civil Division case page summarizes roughly $150 million in penalties and victim compensation (majority earmarked for victims). Public-trade and marketing-press coverage tied the enforcement action to Publicis’s ownership of Epsilon. This BreachHistory row maps the publicis directory slug to that regulatory/criminal data-governance failure (distinct from a single SQL exfiltration event).
Root cause
Organizational sales of consumer marketing data to high-risk clients without adequate abuse controls (per U.S. charging narrative and DPA)