The names and e-mails of customers of Citigroup Inc and other large U.S. companies, were exposed in a massive and growing data breach after a computer hacker penetrated online marketer Epsilon.

In what could be one of the biggest such breaches in U.S. history, a diverse swath of companies that did business with Epsilon stepped forward over the weekend to warn customers some of their electronic information could have been exposed.

A data breach at third-party marketer Epsilon has exposed the e-mail addresses and names of customers at major credit-card issuers, Best Buy, TiVo, and more – potentially leaving users open to phishing attacks.

An unauthorized entry into Epsilon’s email system occurred on March 30, the company said in a statement.

“The information that was obtained was limited to email addresses and/or customer names only,” Epsilon said. “A rigorous assessment determined that no other personal identifiable information associated with those names was at risk. A full investigation is currently underway.”

Best Buy and TiVo, as well as JPMorgan Chase, Citi, Capital One, and more said in statements that they were notified by Epsilon of the breach.

“Best Buy has been informed that the compromised files did not include any personally identifiable information,” the company said. “As always, we are actively communicating with our customers, including providing them with information about how to help protect themselves from potential fraudulent activity. Customers are reminded to ignore emails asking for confidential information.”

“Epsilon does not have access to service information or credit card details and all such personally identifiable information remains secure,” according to TiVo.

In an email to customers, Citi said that Epsilon is “a third-party vendor that provides marketing services to a number of companies.”

Given that the hackers have access to user email addresses, Citi and others warned users of potential phishing attacks, and told customers not to reply to emails that require you to enter personal information.

Other companies reportedly involved in the breach include Walgreens, US Bank, Disney, Home Shopping Network, McKinsey & Company, Ritz-Carlton Rewards, Marriott Rewards, New York & Company, Brookstone, and The College Board.

(Source: PC Mag)