I’m very careful with privacy and security so I was surprised I got an obvious phishing email from “American Express”. I reported the email and moved on only to get another one today. I checked haveibeenpwned and it came back clear. I have never gotten a phishing email before the other day. As for the senders, they all came from generic IT sounding email addresses. They obviously weren’t American Express.
If you have signed up on dubious websites with questionable privacy policy, many of them legally sell this data to “data brokers” who then sell it to anyone willing to pay. This happens more than you’d think, for example in 2019 it was reported California DMV makes $50 million a year selling users information. https://www.caranddriver.com/features/a32035408/dmv-selling-driver-data/
One neat trick is to signup for services with an email like name+website@domain.com, that way if you ever get spam you’ll know where you have been compromised.
Information might also be leaked through data breaches. An email is not a particularly hard thing to find, or even guess.
A spammer could easily just have a computer iterate through all possible combinations of emails and usernames, and shotgun it.
Especially for a name like OP’s. If their email is a similar name, it wouldn’t be difficult for generate one that is also two words.
I’ve used this many times before. But this is so well known I wonder, why wouldn’t spammers/scammers just remove the “+” and trailing characters before “@“?
True. A more reliable way to achieve this is to buy a domain and use addresses in the form websitename@your.domain.
Doesn’t matter how careful you are if the people close yo you with that information aren’t.
‘Why yes ofcourse you can access my address book in order for me to play candy crush.’
Some companies just blatantly sell your data. Others get breached and you are part of the package that gets sold by the hackers.
The only “way around” is to use unique mail addresses for each signup/company so you can easily lock it and switch to another one when it gets known.
Just assume, that everything that you type in a form online (or in any other way send to a company/another person digitally), every email you send, everything that gets digitized about you, etc. will be public one day. Either because the other side of the transaction sold it or because they (or you) will be hacked eventually.
Btw: HaveIBeenPwned does not necessarily contain all breaches. I have several notifications of companies that got breached and leaked my data that are not listed in HIBP…
A few months ago was the largest data breach possibly ever. Something like 300GB of personal information. Basically everyone in the US. They have everything on everyone and it’s being passed all around on the dark web like skittles. The mainstream media didn’t cover this for whatever reason.
Look up “National Private Data Breach”. You’ll find a bunch of articles on it. Although someone else posted a newer one that I haven’t heard about so maybe that one’s worse. I would highly suggest that everyone put a freeze on your credit until you need to apply for something. Lots of identify theft happening since this occured.
Gotta love the compilation releases. By their very nature, they will always have the next largest with even the smallest breach being added.
employees of companies with whom you’ve registered that email id sell it for some quick cash on the side.
i can aver this confidently since i know someone from dominos pizza has leaked my email id. i have a convoluted gmail id which i use to register to all these services and – because it’s gmail – i can set up random dots and a custom phrase behind a + to register specific variants to specific companies (e.g., abcxyz123@gmail vs. ab.c.xyz123+dominos@gmail).
all the spam and pseudo-phishing email is sent only to the variant which i’ve registered to dominos and not to a different variant (e.g., a.bcxyz123+bankname@gmail) registered to any other company.
the leaked email id doesn’t contain a name and is too random for it to just be “guessed” by the spammers.
