How sharing company email addresses puts your business at risk

When employees share their company email addresses with third parties, those addresses become part of their records. If those records are shared, sold or exposed in a breach, the addresses can end up in the hands of others your company never intended to share them with.

Attackers, for example, can use those addresses to identify employees, send spear phishing emails and attempt to access company accounts through password spraying. Across a whole team, that exposure adds up.

When an email address is requested, an employee can ask a simple question: “Does this third party need our company email address?” More often than not, the answer is no.

Phantoms are email aliases that employees can share instead of their company email addresses. This limits how widely your company email addresses are shared.

What a third party receives

Consider a fictional example. Alex subscribes to a newsletter using alex@northstar.example. The publisher now holds Alex’s company email address, including the domain that connects it to Northstar.

A company-domain alias such as research@northstar.example changes the part before the @ symbol but still identifies Northstar through the domain.

With a phantom such as q7m4@mailphantom.example, the email field contains a different address. In this fictional example, mailphantom.example represents a random domain shared across unrelated companies. If that field is exposed, it reveals the phantom rather than Alex’s company email address. Other details in the record could still identify Alex or Northstar. But does a newsletter really need Alex’s real name? Perhaps, for this newsletter, Alex would rather be Marcus.

Why exposure deserves attention

MITRE ATT&CK identifies email-address gathering as a reconnaissance technique: attackers collect email addresses to help them choose and target victims. It recommends minimising the amount and sensitivity of data available to external parties. MITRE ATT&CK T1589.002

Using phantoms applies that principle to the email addresses employees share with third parties. Existing authentication and phishing defences remain essential as part of a defence-in-depth strategy.

A phantom changes which address a third party holds. It cannot prevent a breach or remove information already held, but using phantoms going forward can reduce future exposure by keeping your company email addresses out of more databases.

Where Teams fits

Now imagine Alex and 49 colleagues subscribing to a daily market data feed using their company email addresses. If the publisher’s database is breached and those records are exposed, an attacker looking for a foothold in Northstar now has the email addresses of 50 employees to target.

Mailphantom for Teams enables your employees to use phantoms instead of company email addresses when subscribing to newsletters, downloading reports or creating online accounts.

To get started, subscribe to a newsletter or request a report using a phantom, then check that expected messages arrive.

A separate phantom can act as a tripwire

Using a different phantom for each newsletter subscription or online account has another benefit. For example, Alex uses a phantom to subscribe to one company’s newsletter. If Alex then receives a sales email through that same phantom from an unrelated company, that can be a sign the address has been shared or exposed.

Trezor’s report, published on 14 April 2022, describes how a phishing message sent to a one-time-use email address on 3 April alerted it to a data breach. Further investigation established that its newsletter provider, Mailchimp, had been compromised. Subscriber addresses had been stolen, along with names and IP addresses in some cases. Trezor’s incident report

Mailphantom can act as a tripwire, bringing that same benefit to your team. Using a separate phantom for each third party gives your team a starting point to investigate unexpected emails. You can also block a phantom to stop receiving further email through it.

Check what else you share

The email field is only part of what a third party receives. Names, company details and billing information might still be required for the use of legitimate services.

Even when information is needed to identify an employee or employer, using a phantom can be the start of a useful habit: questioning what you share. Does this form need your company email address? Your real name? A field asking for information is a reason to consider it, rather than automatically provide it.

Before subscribing to a newsletter, requesting a report or creating an account, check what information you are asked for and share only what is needed.

The goal is practical: fewer copies of company email addresses in third-party databases. Give your team phantoms to use instead. See the Teams plan.