The latest data breach, at database marketing company Epsilon, has numerous companies scurrying to notify and pacify their customers.

Travel entities reported to have been hit by the Epsilon hack include Hilton’s HHonors, Marriott, Ritz Carlton and Disney.

As other companies did, Hilton sent an email to rewards program members notifying them of the data breach and assuring them that Epsilon reports that only names and email addresses were pilfered.

“The company was advised by Epsilon that the files accessed did not include any customer financial information and Epsilon has stressed that the only information taken was names and email addresses,” Hilton wrote.

Hilton advised customers to be aware of phishing emails, not to open emails from senders they don’t recognize and not to share personal information in emails.

Marriott, too, posted a response to the security breach on its website.

Epsilon says it became aware of the incident on March 30 “where a subset of Epsilon clients’ customer data were exposed by an unauthorized entry into Epsilon’s email system.” The company says a “full investigation” is under way.

Meanwhile, if that wasn’t enough to put consumers on edge, Pandora, an Internet radio provider, said that it received a subpoena early this year about a federal grand jury investigation into “the information sharing processes of certain popular applications that run on the Apple and Android mobile platforms.”

Pandora said it “believes that similar subpoenas were issued on an industry-wide basis to the publishers of numerous other smartphone applications…”

It is believed that the grand jury may be focusing on the manner in which apps publishers transmit information about users to third parties, including advertising networks.

Pandora made the revelation in connection with an amended prospectus for an IPO.

Between email hacks and data privacy practices, travel marketers likely will have to double-down on data security efforts and may have an uphill battle in assuring the public that ecommerce is safe.

The stunning reversal occurred as media outlets throughout the country picked up the story that the DHS and TSA were playing hardball and going after Elliott and blogger Steven Frischling with subpoenas and tough tactics after they published the post-Northwest flight 253 security directive on new passenger screening rules.

Perhaps dropping the subpoena on New Year’s Eve made more sense than letting the issue and the bad publicity for the TSA linger through upcoming news cycles.

Elliott, who wouldn’t comment while the subpoena was pending, says tonight, Dec. 31, that he was hearing all day from multiple sources that the “TSA was going to cave.”

“There definitely was some damage control going on here,” Elliott says.

Elliott says he feels “very pleased with the outcome” as he was prepared to dig in to protect confidential sources.

He was surprised with the speed of the DHS reversal, adding that he knew the department was considering withdrawing the subpoena, but expected the move to come perhaps next Monday or Tuesday.

Short of a withdrawal, Elliott says he and his attorney had been considering filing a motion to quash the subpoena or to allow the clock to run out and let the Jan. 20 deadline lapse. Earlier today, the DHS had extended the initial deadline for compliance with the subpoena from Dec. 31 to Jan. 20 at the request of Elliott’s attorney, but withdrew the subpoena outright this evening.

Among the issues that remain is whether the TSA investigators were able to find the source of the leaked document from their examination of Frischling’s computer or perhaps through other means, making the subpoena of Elliott unnecessary.

The TSA couldn’t be reached for comment.

UPDATE: The DHS this afternoon gave journalist Chris Elliott an extension until Jan. 20 to comply with a subpoena, his attorney told Tnooz. The initial deadline was Dec. 31.

The original post follows:

Facing a Dept. of Homeland Security subpoena and its Dec. 31 deadline, travel journalist Chris Elliott has not turned over any documents related to the source who provided him with the TSA’s secret Christmas Day security directive, his attorney says.

Attorney Anthony Elia, who’s representing Elliott, says he e-mailed a request Dec. 31 to TSA special agent Robert Flaherty, who served the civil subpoena at Elliott’s home on the evening of Dec. 29, asking for “additional time to allow the process to unfold in a reasonable way.”

Giving Elliott roughly two days to respond to the subpoena was an “inordinately short” period of time and “unreasonable,” Elia says, given the serious nature of the issues.

Elliott faces up to one year in prison and fines for failing to comply with the subpoena by Dec. 31, according to the document.

“It’s not something that should happen in two days,” Elia says, referring to dealing with the subpoena.

In the letter, Elia also objected to the subpoena, noting that there are First Amendment issues involved when the government compels a journalist to turn over confidential information, sources and materials.

“It should only be done under certain limited circumstances,” Elia says.

Elia says Elliott needs appropriate time to respond to the subpoena, but the attorney declined to detail what actions Elliott may take, if any, or what strategy he may follow.

The DHS subpoenaed Elliott and blogger Steve Frischling Dec. 29 after they published the security directive, which outlines new screening measures for international flights arriving in the U.S., on their respective blogs.

Elliott’s stance contrasts with Frischling’s, who apparently wasn’t represented by an attorney until after he already had signed a statement saying he didn’t know the identity of the source and gave his consent — he says under pressure –  to handing over the hard drive to his computer, which he did Dec. 30. The hard drive was returned later in the day, but Frischling says it was damaged in the process.

Also, although Elliott apparently hasn’t assisted the TSA in its investigation of the leak, Frischling’s twitter account issued the following tweet on Dec. 29 at 10:05 p.m., at a time when two TSA agents could well have been in his home:

“To the gentleman who sent Flying With Fish the TSA Security Directive … Thank You! Can you drop me an email?I have a question. Thanks-Fish”

If you peruse Frischling’s personal Twitter account, the above tweet stands out as stylistically uncharacteristic, leading to questions about the origins of or circumstances surrounding the tweet and how any response may have been utilized.

Meanwhile, in addition to his personal blog and Twitter accounts, Frischling began blogging for KLM at the launch of the airline’s blog in mid-December and also handles the KLM Twitter account.

Frischling said Dec. 30 — prior to signing a statement and turning over his computer — that the two TSA agents who visited his Connecticut home warned him they would contact KLM over the security-directive  issue if he didn’t comply with the subpoena, and that this would end his ability to work with the airline industry. Frischling also is an airline industry consultant and corporate photographer.

Frischling said Dec. 31 that KLM has been supportive and cautioned him not to reference his TSA issue on the KLM blog or Twitter account.

In another development, I asked Google whether it had received a subpoena from the DHS about the security directive since the source apparently used a Gmail account to e-mail the security directive to Elliott and Frishling.

Google spokesman Brian Richardson responded: “We actually don’t talk about individual cases or potential requests to help protect all our users.  Obviously, we follow the law like any other company.  When we receive a subpoena or court order, we check to see if it meets both the letter and the spirit of the law before complying.  And if doesn’t we can object or ask that the request is narrowed.  We have a track record of advocating on behalf of our users.”