Where mailing lists leaked

A flaw in Brevo's single sign-on let an attacker into 138 customer accounts. Contacts were exported from 43, including 347,149 Trezor newsletter addresses, and 6 sent phishing.

Someone got into Canny, a feedback tool connected to Canva's Salesforce, and reached enterprise customers' business contact details.

A misconfigured sign-up form passed new customers' emails, passwords and phone numbers to third-party ad pixels, likely from February 2024 to November 2025.

A vendor's stolen credentials opened HungerRush's email marketing account, which mailed extortion emails to restaurant patrons.

A breach exposed 250,000 email addresses, and its system was used to send newsletters falsely attributed to contributors.

900,000 email addresses leaked, mostly from a marketing tool belonging to a company Aura had acquired.

An outside party got users' email addresses and phone numbers in October 2025. Substack found it on February 3.

Social engineering opened a third-party marketing platform. Customer contact data was taken and a crypto scam mailed from a Betterment address; 1.4 million emails.

2.3 million WIRED user records, mostly email addresses and display names, were published online.

An attacker exported names and emails of OpenAI API users from its analytics vendor.

Attackers broke into a support contractor and reached users' emails, contact details and about 70,000 ID photos.

A fake npm copy of Postmark's MCP email connector for AI assistants quietly Bcc'd every email it sent to the attacker.

Through the Salesloft Drift Salesforce integration, an attacker took support case text and customer contact data, including requester email addresses and phone numbers.

Palo Alto Networks said the Drift-linked breach was limited to its Salesforce CRM and mostly exposed business contact information plus sales account and case data.

Workiva said attackers used a connected third-party application to reach its CRM and took business contacts' names, email addresses, phone numbers and support ticket content.

Stellantis said a third-party platform for its North American customer service was breached, exposing customer data limited to names and email addresses.

Stolen OAuth tokens were used to export many companies' Salesforce data and to read mail in some Google Workspace accounts.

Social engineering opened a third-party CRM, and business contact names, emails and phone numbers were taken.

Voice phishing led to data stolen from a corporate Salesforce instance holding business contacts.

A voice-phishing attack gave an attacker access to a third-party CRM, from which names, email addresses, phone numbers and addresses of Cisco.com users were exported.

Chanel said a database at a third-party provider was accessed, exposing names, email addresses, mailing addresses and phone numbers of US client care contacts.

Pandora told customers their contact information was accessed through a third-party platform; BleepingComputer reported the source was its Salesforce database.

Attackers reached an external customer service platform and took customer names, email addresses, phone numbers and loyalty program details.

Stolen Drift OAuth tokens gave access to Zscaler's Salesforce, exposing customer names, business email addresses, job titles, phone numbers and support case header fields.

Customer data stored in Salesforce was taken through social engineering; 1.1 million emails.

A contact centre's third-party platform was breached and 5.7 million customer records taken, about 4 million with emails.

A crafted email could make Copilot send internal data to an attacker with no click. Fixed, with no known use in real attacks.

Bribed support contractors took customers' names, emails, addresses and ID images.

Adidas said contact information of customers who had contacted its help desk was taken from a third-party customer service provider.

Copied login pages took over Mailchimp, SendGrid, HubSpot, Mailgun and Zoho accounts to export lists and mail wallet scams.

A phishing page relayed his password and one-time code. His list of about 16,000 was exported in two minutes, 7,535 of them people who had unsubscribed.

A support API token, exposed in a config file since 2022, was used to email people with old support tickets.

Almost 300,000 email addresses were taken from a real estate marketing platform.

An attack on a marketing automation platform exposed 3.2 million customer email addresses.

Atlassian confirmed that 15 million Trello users' email addresses were collected through an unauthenticated REST API lookup, which it closed in January 2024.

Attackers got into fewer than 50 customer accounts.

A hijacked GetResponse employee account was used to export 1,916,596 CoinGecko contacts and phish 23,723 addresses.

Customer names and contact details were taken from a third-party data warehouse.

Attackers reached Dropbox Sign's production systems and took customer emails, usernames, phone numbers, hashed passwords and API keys, plus names and emails of non-users.

Its newsletter key was taken and a fake airdrop mailed to subscribers.

At least nine companies' SendGrid accounts sent phishing imitating SendGrid itself, passing SPF and DKIM.

122 million business contact records leaked from a decommissioned system of the B2B data company.

A phished support manager gave attackers the admin panel. 70 accounts were reached and 4 sent wallet-drainer phishing.

A misconfigured API exposed email addresses, names, phone numbers, bcrypt password hashes and 2FA secrets for about 207,000 accounts.

Okta said intruders in its customer support system took the names and email addresses of all its support system users.

Data on 2.6M users, including non-public email addresses, was scraped through an exposed API and released on a hacking forum.

DHL and MetaMask phishing went to customers through its email sender.

Phished staff credentials opened an internal admin tool, and data in 133 accounts was accessed, WooCommerce's among them.

An attacker pulled names, email addresses, billing addresses and phone numbers for about 37 million customer accounts through an API.

Social engineering of staff reached 214 accounts and exposed DigitalOcean customers' emails.

A phished employee login was used to download marketing lists from 38 accounts.

Twitter confirmed that a now-patched flaw let attackers link email addresses and phone numbers to accounts; the attacker's dataset covered about 5.4M users.

Attackers used stolen credentials from a third-party vendor to reach internal tools, exposing names, email addresses, delivery addresses and phone numbers of customers and couriers.

An incident at its email marketing provider exposed 188,000 unique email addresses.

An employee of the email vendor downloaded users' and subscribers' emails and shared them.

319 accounts were accessed, audience data exported from 102, and Trezor subscribers phished.

A social-engineered employee login was used to export contacts from crypto customers such as BlockFi, Swan and Circle.

A contractor's stolen SES token sent Office 365 phishing from a kaspersky.com address.

An attacker talked a support employee into granting access to customer support systems and took a list of about five million customer email addresses.

Its marketing account sent 121 phishing and malware emails over four days.

Attackers got into USAID's Constant Contact account and sent phishing to about 3,000 accounts at over 150 organizations.

A scraping method published by a researcher was used to collect names, usernames and email hashes for 167M profiles; about 114M addresses were later cracked.

Customer accounts with reused passwords were taken over to send phishing, and over 400 were offered for sale.

An API key opened its marketing database and exposed about 1 million emails.

Unpatched SaltStack flaws let attackers into Ghost's server infrastructure and took the hosted service down.

A breach exposed 858,000 unique email addresses from customer records and newsletter subscribers.

An unprotected server holding 1.2 billion records sourced from People Data Labs exposed 622 million unique email addresses; PDL did not own the server.

The B2B leads service exposed 17.8 million unique email addresses through an unsecured database.

An exposed spam server held more than three million email addresses and passwords used to send spam from hijacked mailboxes.

An email validation service left a database open, exposing 763 million email addresses.

An unprotected database linked to marketing company Data & Leads exposed over 44 million unique email addresses with names and employment data.

An API bug let some calls read or write data across customer accounts.

Sales engagement startup Apollo left a database exposed without a password, and 126 million unique email addresses from it reached Have I Been Pwned.

A marketing data firm left a database open with about 340 million records of emails, addresses and phone numbers.

A misconfigured server for the Trik spam botnet exposed the email addresses of more than 43 million people.

Hijacked accounts, Red Bull Records' among them, mailed malware to their own lists for months.

A spam server exposed 711 million records, with the email logins used to send spam.

A backup with no password exposed 1.37 billion rows, about 393 million unique addresses.

33.7 million business contacts from its NetProspex list leaked.

Accounts were taken over to mail malware invoices to their own subscribers.

A spam list with 30.7 million identities was found.

An employee account reached customer credentials and servers holding recipient lists.

US prosecutors charged hackers who broke into at least eight email providers from 2009, took over a billion addresses and used the providers' servers to spam.

Emails of people who wrote to Twitter, Pinterest and Tumblr support were taken.

A reused password opened an employee account holding a list of user emails, which led to spam.

Customer names and emails for Citibank, Chase, Capital One, Marriott and others were taken from the email marketer.

Spear-phishing hit staff at over 100 email providers, and some Silverpop customer accounts were reached.

Its email database, reported as 13 million addresses, was taken from its email provider.

Its newsletter list was taken and used for phishing.

Customer emails and other promotion sign-up data leaked from a hacked email database firm working for McDonald's agency Arc Worldwide.

An unnamed email vendor's breach exposed about 4.9 million Owner Link and My Acura records, including email addresses, names and VINs.

Attackers broke into Campaign Monitor servers, got into some customer accounts and sent spam from both existing and imported lists.

Contact details for more than 6.3 million accounts were taken, emails included.