# Where mailing lists leaked

93 times a list of people's email addresses, or the account that mails them, ended up with someone else.

Breaches that came in through a third party doubled to 30% in Verizon's 2025 report, and stood at 48% in 2026. Sources: [Verizon DBIR 2025](https://www.verizon.com/about/news/2025-data-breach-investigations-report), [Verizon DBIR 2026](https://www.verizon.com/about/news/breach-industry-wide-dbir-finds).

## 2026

- **Sep, Brevo.** A flaw in Brevo's single sign-on let an attacker into 138 customer accounts. Contacts were exported from 43, including 347,149 Trezor newsletter addresses, and 6 sent phishing. [BleepingComputer](https://www.bleepingcomputer.com/news/security/trezor-347-000-users-targeted-in-phishing-attacks-after-brevo-breach/)
- **Sep, Canva.** Someone got into Canny, a feedback tool connected to Canva's Salesforce, and reached enterprise customers' business contact details. [Capital Brief](https://www.capitalbrief.com/article/canva-enterprise-customer-data-exposed-in-third-party-breach-b926931e-7c1b-4c1e-9f55-a3354cb0a1ed/)
- **Aug, Klaviyo.** A misconfigured sign-up form passed new customers' emails, passwords and phone numbers to third-party ad pixels, likely from February 2024 to November 2025. [TechCrunch](https://techcrunch.com/2026/08/10/signed-up-for-klaviyo-dozens-of-advertisers-may-have-seen-your-password/)
- **Mar, HungerRush.** A vendor's stolen credentials opened HungerRush's email marketing account, which mailed extortion emails to restaurant patrons. [BleepingComputer](https://www.bleepingcomputer.com/news/security/hacker-mass-mails-hungerrush-extortion-emails-to-restaurant-patrons/)
- **Mar, SUCCESS magazine.** A breach exposed 250,000 email addresses, and its system was used to send newsletters falsely attributed to contributors. [Have I Been Pwned](https://haveibeenpwned.com/Breach/SUCCESS)
- **Mar, Aura.** 900,000 email addresses leaked, mostly from a marketing tool belonging to a company Aura had acquired. [Have I Been Pwned](https://haveibeenpwned.com/Breach/Aura)
- **Feb, Substack.** An outside party got users' email addresses and phone numbers in October 2025. Substack found it on February 3. [TechCrunch](https://techcrunch.com/2026/02/05/substack-confirms-data-breach-affecting-email-addresses-and-phone-numbers/)
- **Jan, Betterment.** Social engineering opened a third-party marketing platform. Customer contact data was taken and a crypto scam mailed from a Betterment address; 1.4 million emails. [BleepingComputer](https://www.bleepingcomputer.com/news/security/betterment-confirms-data-breach-after-wave-of-crypto-scam-emails/)

## 2025

- **Dec, WIRED.** 2.3 million WIRED user records, mostly email addresses and display names, were published online. [Have I Been Pwned](https://haveibeenpwned.com/Breach/WIRED)
- **Nov, OpenAI via Mixpanel.** An attacker exported names and emails of OpenAI API users from its analytics vendor. [The Register](https://www.theregister.com/2025/11/27/openai_mixpanel_api/)
- **Oct, Discord via 5CA.** Attackers broke into a support contractor and reached users' emails, contact details and about 70,000 ID photos. [Discord](https://discord.com/press-releases/update-on-security-incident-involving-third-party-customer-service)
- **Sep, postmark-mcp.** A fake npm copy of Postmark's MCP email connector for AI assistants quietly Bcc'd every email it sent to the attacker. [CSO](https://csoonline.com/article/4064009/trust-in-mcp-takes-first-in-the-wild-hit-via-squatted-postmark-connector.html)
- **Sep, Cloudflare.** Through the Salesloft Drift Salesforce integration, an attacker took support case text and customer contact data, including requester email addresses and phone numbers. [Cloudflare](https://blog.cloudflare.com/response-to-salesloft-drift-incident/)
- **Sep, Palo Alto Networks.** Palo Alto Networks said the Drift-linked breach was limited to its Salesforce CRM and mostly exposed business contact information plus sales account and case data. [Cybersecurity Dive](https://www.cybersecuritydive.com/news/palo-alto-networks-zscaler-supply-chain-attacks/758990/)
- **Sep, Workiva.** Workiva said attackers used a connected third-party application to reach its CRM and took business contacts' names, email addresses, phone numbers and support ticket content. [BleepingComputer](https://www.bleepingcomputer.com/news/security/saas-giant-workiva-discloses-data-breach-after-salesforce-attack/)
- **Sep, Stellantis.** Stellantis said a third-party platform for its North American customer service was breached, exposing customer data limited to names and email addresses. [The Register](https://www.theregister.com/2025/09/22/stellantis_breach/)
- **Aug, Salesloft Drift.** Stolen OAuth tokens were used to export many companies' Salesforce data and to read mail in some Google Workspace accounts. [Google](https://cloud.google.com/blog/topics/threat-intelligence/data-theft-salesforce-instances-via-salesloft-drift)
- **Aug, Workday.** Social engineering opened a third-party CRM, and business contact names, emails and phone numbers were taken. [BleepingComputer](https://www.bleepingcomputer.com/news/security/hr-giant-workday-discloses-data-breach-amid-salesforce-attacks/)
- **Aug, Google.** Voice phishing led to data stolen from a corporate Salesforce instance holding business contacts. [BleepingComputer](https://www.bleepingcomputer.com/news/security/google-suffers-data-breach-in-ongoing-salesforce-data-theft-attacks/)
- **Aug, Cisco.** A voice-phishing attack gave an attacker access to a third-party CRM, from which names, email addresses, phone numbers and addresses of Cisco.com users were exported. [TechCrunch](https://techcrunch.com/2025/08/05/hacker-used-a-voice-phishing-attack-to-steal-cisco-customers-personal-information)
- **Aug, Chanel.** Chanel said a database at a third-party provider was accessed, exposing names, email addresses, mailing addresses and phone numbers of US client care contacts. [BleepingComputer](https://www.bleepingcomputer.com/news/security/fashion-giant-chanel-hit-in-wave-of-salesforce-data-theft-attacks/)
- **Aug, Pandora.** Pandora told customers their contact information was accessed through a third-party platform; BleepingComputer reported the source was its Salesforce database. [BleepingComputer](https://www.bleepingcomputer.com/news/security/pandora-confirms-data-breach-amid-ongoing-salesforce-data-theft-attacks/)
- **Aug, Air France-KLM.** Attackers reached an external customer service platform and took customer names, email addresses, phone numbers and loyalty program details. [BleepingComputer](https://www.bleepingcomputer.com/news/security/air-france-and-klm-disclose-data-breaches-impacting-customers/)
- **Aug, Zscaler.** Stolen Drift OAuth tokens gave access to Zscaler's Salesforce, exposing customer names, business email addresses, job titles, phone numbers and support case header fields. [Zscaler](https://www.zscaler.com/blogs/company-news/salesloft-drift-supply-chain-incident-key-details-and-zscaler-s-response)
- **Jul, Allianz Life.** Customer data stored in Salesforce was taken through social engineering; 1.1 million emails. [Have I Been Pwned](https://haveibeenpwned.com/Breach/AllianzLife)
- **Jul, Qantas.** A contact centre's third-party platform was breached and 5.7 million customer records taken, about 4 million with emails. [SecurityWeek](https://www.securityweek.com/qantas-confirms-5-7-million-impacted-by-data-breach/)
- **Jun, Microsoft 365 Copilot.** A crafted email could make Copilot send internal data to an attacker with no click. Fixed, with no known use in real attacks. [BleepingComputer](https://www.bleepingcomputer.com/news/security/zero-click-ai-data-leak-flaw-uncovered-in-microsoft-365-copilot/)
- **May, Coinbase.** Bribed support contractors took customers' names, emails, addresses and ID images. [BleepingComputer](https://www.bleepingcomputer.com/news/security/coinbase-discloses-breach-faces-up-to-400-million-in-losses/)
- **May, Adidas.** Adidas said contact information of customers who had contacted its help desk was taken from a third-party customer service provider. [The Register](https://www.theregister.com/2025/05/27/adidas_confirms_data_theft/)
- **Apr, PoisonSeed.** Copied login pages took over Mailchimp, SendGrid, HubSpot, Mailgun and Zoho accounts to export lists and mail wallet scams. [BleepingComputer](https://www.bleepingcomputer.com/news/security/poisonseed-phishing-campaign-behind-emails-with-wallet-seed-phrases/)
- **Mar, Troy Hunt via Mailchimp.** A phishing page relayed his password and one-time code. His list of about 16,000 was exported in two minutes, 7,535 of them people who had unsubscribed. [Troy Hunt](https://www.troyhunt.com/a-sneaky-phish-just-grabbed-my-mailchimp-mailing-list/)

## 2024

- **Oct, Internet Archive via Zendesk.** A support API token, exposed in a config file since 2022, was used to email people with old support tickets. [BleepingComputer](https://www.bleepingcomputer.com/news/security/internet-archive-breached-again-through-exposed-access-tokens/)
- **Oct, Finsure via ActivePipe.** Almost 300,000 email addresses were taken from a real estate marketing platform. [Have I Been Pwned](https://haveibeenpwned.com/Breach/Finsure)
- **Aug, Burger King Russia via Mindbox.** An attack on a marketing automation platform exposed 3.2 million customer email addresses. [Have I Been Pwned](https://haveibeenpwned.com/Breach/BurgerKingRussia)
- **Jul, Trello.** Atlassian confirmed that 15 million Trello users' email addresses were collected through an unauthenticated REST API lookup, which it closed in January 2024. [BleepingComputer](https://www.bleepingcomputer.com/news/security/email-addresses-of-15-million-trello-users-leaked-on-hacking-forum/)
- **Jun, HubSpot.** Attackers got into fewer than 50 customer accounts. [TechCrunch](https://techcrunch.com/2024/06/28/hubspot-says-its-investigating-customer-account-hacks/)
- **Jun, CoinGecko via GetResponse.** A hijacked GetResponse employee account was used to export 1,916,596 CoinGecko contacts and phish 23,723 addresses. [CoinGecko](https://www.coingecko.com/learn/getresponse-data-breach-june-2024)
- **May, Ticketmaster via Snowflake.** Customer names and contact details were taken from a third-party data warehouse. [BleepingComputer](https://www.bleepingcomputer.com/news/security/ticketmaster-sends-notifications-about-recent-massive-data-breach/)
- **May, Dropbox Sign.** Attackers reached Dropbox Sign's production systems and took customer emails, usernames, phone numbers, hashed passwords and API keys, plus names and emails of non-users. [BleepingComputer](https://www.bleepingcomputer.com/news/security/dropbox-says-hackers-stole-customer-data-auth-secrets-from-esignature-service/)
- **Mar, Decrypt via MailerLite.** Its newsletter key was taken and a fake airdrop mailed to subscribers. [Decrypt](https://decrypt.co/224133/phishing-email-decrypt-newsletter-latest)
- **Feb, SendGrid customers.** At least nine companies' SendGrid accounts sent phishing imitating SendGrid itself, passing SPF and DKIM. [Netcraft](https://www.netcraft.com/blog/popular-email-platform-used-to-impersonate-itself)
- **Feb, DemandScience.** 122 million business contact records leaked from a decommissioned system of the B2B data company. [BleepingComputer](https://www.bleepingcomputer.com/news/security/leaked-info-of-122-million-linked-to-b2b-data-aggregator-breach/)
- **Jan, MailerLite.** A phished support manager gave attackers the admin panel. 70 accounts were reached and 4 sent wallet-drainer phishing. [MailerLite](https://www.mailerlite.com/newsroom/securityincidentnotice)
- **Jan, Spoutible.** A misconfigured API exposed email addresses, names, phone numbers, bcrypt password hashes and 2FA secrets for about 207,000 accounts. [Have I Been Pwned](https://haveibeenpwned.com/breach/Spoutible)

## 2023

- **Nov, Okta.** Okta said intruders in its customer support system took the names and email addresses of all its support system users. [Krebs on Security](https://krebsonsecurity.com/2023/11/okta-breach-affected-all-customer-support-users/)
- **Aug, Duolingo.** Data on 2.6M users, including non-public email addresses, was scraped through an exposed API and released on a hacking forum. [BleepingComputer](https://www.bleepingcomputer.com/news/security/scraped-data-of-26-million-duolingo-users-released-on-hacking-forum/)
- **Feb, Namecheap.** DHL and MetaMask phishing went to customers through its email sender. [The Register](https://www.theregister.com/2023/02/13/namecheap)
- **Jan, Mailchimp.** Phished staff credentials opened an internal admin tool, and data in 133 accounts was accessed, WooCommerce's among them. [TechCrunch](https://techcrunch.com/2023/01/18/mailchimp-hacked/)
- **Jan, T-Mobile.** An attacker pulled names, email addresses, billing addresses and phone numbers for about 37 million customer accounts through an API. [BleepingComputer](https://www.bleepingcomputer.com/news/security/t-mobile-hacked-to-steal-data-of-37-million-accounts-in-api-data-breach)

## 2022

- **Aug, Mailchimp.** Social engineering of staff reached 214 accounts and exposed DigitalOcean customers' emails. [BleepingComputer](https://www.bleepingcomputer.com/news/security/new-mailchimp-breach-exposed-digitalocean-customer-email-addresses/)
- **Aug, Klaviyo.** A phished employee login was used to download marketing lists from 38 accounts. [Klaviyo](https://www.klaviyo.com/blog/august-2022-security-incident)
- **Aug, Twitter.** Twitter confirmed that a now-patched flaw let attackers link email addresses and phone numbers to accounts; the attacker's dataset covered about 5.4M users. [BleepingComputer](https://www.bleepingcomputer.com/news/security/twitter-confirms-zero-day-used-to-expose-data-of-54-million-accounts/)
- **Aug, DoorDash.** Attackers used stolen credentials from a third-party vendor to reach internal tools, exposing names, email addresses, delivery addresses and phone numbers of customers and couriers. [BleepingComputer](https://www.bleepingcomputer.com/news/security/doordash-discloses-new-data-breach-tied-to-twilio-hackers/)
- **Jul, Vultr via ActiveCampaign.** An incident at its email marketing provider exposed 188,000 unique email addresses. [Have I Been Pwned](https://haveibeenpwned.com/Breach/Vultr)
- **Jun, OpenSea via Customer.io.** An employee of the email vendor downloaded users' and subscribers' emails and shared them. [The Register](https://www.theregister.com/2022/06/30/opensea_data_breach_phishing/)
- **Mar, Mailchimp.** 319 accounts were accessed, audience data exported from 102, and Trezor subscribers phished. [The Record](https://therecord.media/hacker-accessed-319-crypto-and-finance-related-mailchimp-accounts-company-said)
- **Mar, HubSpot.** A social-engineered employee login was used to export contacts from crypto customers such as BlockFi, Swan and Circle. [HubSpot](https://www.hubspot.com/en-us/march-2022-security-incident)

## 2021

- **Nov, Kaspersky via Amazon SES.** A contractor's stolen SES token sent Office 365 phishing from a kaspersky.com address. [Threatpost](https://threatpost.com/office-365-phishing-campaign-kasperskys-amazon-ses-token/175915/)
- **Nov, Robinhood.** An attacker talked a support employee into granting access to customer support systems and took a list of about five million customer email addresses. [The Register](https://www.theregister.com/2021/11/09/robinhood_breach/)
- **Jul, Chipotle via Mailgun.** Its marketing account sent 121 phishing and malware emails over four days. [The Register](https://www.theregister.com/2021/07/29/mailgun_chipotle_malware_spam/)
- **May, USAID via Constant Contact.** Attackers got into USAID's Constant Contact account and sent phishing to about 3,000 accounts at over 150 organizations. [Microsoft](https://blogs.microsoft.com/on-the-issues/2021/05/27/nobelium-cyberattack-nativezone-solarwinds/)

## 2020

- **Oct, Gravatar.** A scraping method published by a researcher was used to collect names, usernames and email hashes for 167M profiles; about 114M addresses were later cracked. [Have I Been Pwned](https://haveibeenpwned.com/breach/gravatar)
- **Aug, SendGrid.** Customer accounts with reused passwords were taken over to send phishing, and over 400 were offered for sale. [Krebs on Security](https://krebsonsecurity.com/2020/08/sendgrid-under-siege-from-hacked-accounts/)
- **Jun, Ledger.** An API key opened its marketing database and exposed about 1 million emails. [Ledger](https://www.ledger.com/addressing-the-july-2020-e-commerce-and-marketing-data-breach)
- **May, Ghost(Pro).** Unpatched SaltStack flaws let attackers into Ghost's server infrastructure and took the hosted service down. [CSO](https://www.csoonline.com/article/3541721/cloud-servers-hacked-via-critical-saltstack-vulnerabilities.html)
- **Feb, Slickwraps.** A breach exposed 858,000 unique email addresses from customer records and newsletter subscribers. [Have I Been Pwned](https://haveibeenpwned.com/Breach/Slickwraps)

## 2019

- **Oct, People Data Labs data.** An unprotected server holding 1.2 billion records sourced from People Data Labs exposed 622 million unique email addresses; PDL did not own the server. [Have I Been Pwned](https://haveibeenpwned.com/Breach/PDL)
- **Aug, LimeLeads.** The B2B leads service exposed 17.8 million unique email addresses through an unsecured database. [Have I Been Pwned](https://haveibeenpwned.com/Breach/LimeLeads)
- **Mar, Intelimost.** An exposed spam server held more than three million email addresses and passwords used to send spam from hijacked mailboxes. [TechCrunch](https://techcrunch.com/2019/04/02/inside-a-spam-operation/)
- **Feb, Verifications.io.** An email validation service left a database open, exposing 763 million email addresses. [Have I Been Pwned](https://haveibeenpwned.com/Breach/VerificationsIO)

## 2018

- **Nov, Data & Leads.** An unprotected database linked to marketing company Data & Leads exposed over 44 million unique email addresses with names and employment data. [Have I Been Pwned](https://haveibeenpwned.com/Breach/DataAndLeads)
- **Jul, Salesforce Marketing Cloud.** An API bug let some calls read or write data across customer accounts. [The Register](https://www.theregister.com/2018/08/06/salesforce_breach/)
- **Jul, Apollo.** Sales engagement startup Apollo left a database exposed without a password, and 126 million unique email addresses from it reached Have I Been Pwned. [Have I Been Pwned](https://haveibeenpwned.com/Breach/Apollo)
- **Jun, Exactis.** A marketing data firm left a database open with about 340 million records of emails, addresses and phone numbers. [Engadget](https://www.engadget.com/2018/06/28/exactis-leak-340-million-records/)
- **Jun, Trik Spam Botnet.** A misconfigured server for the Trik spam botnet exposed the email addresses of more than 43 million people. [Have I Been Pwned](https://haveibeenpwned.com/Breach/TrikSpamBotnet)

## 2017

- **Dec, Mailchimp customers.** Hijacked accounts, Red Bull Records' among them, mailed malware to their own lists for months. [The Register](https://www.theregister.com/2018/03/15/mailchimp_malware_spam/)
- **Aug, Onliner Spambot.** A spam server exposed 711 million records, with the email logins used to send spam. [Troy Hunt](https://www.troyhunt.com/inside-the-massive-711-million-record-onliner-spambot-dump/)
- **Mar, River City Media.** A backup with no password exposed 1.37 billion rows, about 393 million unique addresses. [The Register](https://www.theregister.com/2017/03/07/rcm_email_megaleak/)
- **Mar, Dun & Bradstreet.** 33.7 million business contacts from its NetProspex list leaked. [Troy Hunt](https://www.troyhunt.com/weve-lost-control-of-our-personal-data-including-33m-netprospex-records/)

## 2016

- **Nov, Mailchimp customers.** Accounts were taken over to mail malware invoices to their own subscribers. [WeLiveSecurity](https://www.welivesecurity.com/2016/11/23/mailchimp-accounts-hacked-spam-malicious-emails/)

## 2015

- **Oct, Special K spam list.** A spam list with 30.7 million identities was found. [Have I Been Pwned](https://haveibeenpwned.com/api/v3/breach/SpecialKSpamList)
- **Apr, SendGrid.** An employee account reached customer credentials and servers holding recipient lists. [Krebs on Security](https://krebsonsecurity.com/2015/04/sendgrid-employee-account-hacked-used-to-steal-customer-credentials/)
- **Mar, Eight US email service providers.** US prosecutors charged hackers who broke into at least eight email providers from 2009, took over a billion addresses and used the providers' servers to spam. [The Register](https://www.theregister.com/on-prem/2015/03/06/billion-email-address-spam-scam-feds-collar-two-blokes-hunt-another/448166)

## 2013

- **Feb, Zendesk.** Emails of people who wrote to Twitter, Pinterest and Tumblr support were taken. [TechCrunch](https://techcrunch.com/2013/02/21/zendesk-hacking-affects-tumblr-pinterest-and-twitter-customers/)

## 2012

- **Jul, Dropbox.** A reused password opened an employee account holding a list of user emails, which led to spam. [Krebs on Security](https://krebsonsecurity.com/2012/07/dropbox-password-breach-led-to-spam/)

## 2011

- **Apr, Epsilon.** Customer names and emails for Citibank, Chase, Capital One, Marriott and others were taken from the email marketer. [The Register](https://www.theregister.com/2011/04/03/epsilon_email_breach)

## 2010

- **Dec, Silverpop.** Spear-phishing hit staff at over 100 email providers, and some Silverpop customer accounts were reached. [The Register](https://www.theregister.com/2010/12/15/silverpop_breach_probe/)
- **Dec, deviantART via Silverpop.** Its email database, reported as 13 million addresses, was taken from its email provider. [Krebs on Security](https://krebsonsecurity.com/2010/12/fallout-from-recent-spear-phishing-attacks/)
- **Dec, Walgreens.** Its newsletter list was taken and used for phishing. [SecurityWeek](https://www.securityweek.com/walgreens-customer-email-list-falls-hands-hackers/)
- **Dec, McDonald's.** Customer emails and other promotion sign-up data leaked from a hacked email database firm working for McDonald's agency Arc Worldwide. [Krebs on Security](https://krebsonsecurity.com/2010/12/fallout-from-recent-spear-phishing-attacks/)
- **Dec, Honda and Acura.** An unnamed email vendor's breach exposed about 4.9 million Owner Link and My Acura records, including email addresses, names and VINs. [American Banker](https://www.americanbanker.com/payments/news/honda-data-breach-affects-49-million-customers)

## 2009

- **Aug, Campaign Monitor.** Attackers broke into Campaign Monitor servers, got into some customer accounts and sent spam from both existing and imported lists. [The Register](https://www.theregister.com/2009/08/11/campaign_monitor_hack_spam_attack/)

## 2007

- **Sep, TD Ameritrade.** Contact details for more than 6.3 million accounts were taken, emails included. [The Register](https://www.theregister.com/2007/09/15/ameritrade_database_burgled/)