Security researchers have discovered that hundreds of organizations are inadvertently sending private information and corporate secrets to 'noreply' and 'deleteduser' domains owned by private individuals.

Key Takeaways

  • Researchers purchased domains like noreply.net to intercept misdirected sensitive data.
  • Leaked info includes injury reports, credentials, and even CCTV stills from AI firms.
  • Companies often replace user emails with 'deleteduser.com' instead of deleting accounts.
  • This massive oversight poses a significant risk if exploited by malicious actors.

In a startling revelation for the cybersecurity community, researchers Cory Solovewicz and Mike Sheward have uncovered a massive leak where sensitive corporate and personal data is being sent to 'dead-end' email addresses. By purchasing domains such as noreply.net and deleteduser.com, these researchers have essentially created a massive, accidental honeypot of leaked information.

Solovewicz reported receiving an average of nearly 700 emails per day. These are not mere marketing spam; they consist of high-stakes data including government injury reports, school platform credentials, and even internal service orders. The sheer volume of automated messages highlights a systemic failure in how large organizations manage automated communications.

Why This Matters

BozokMedia analysis shows that this is not just a minor configuration error but a fundamental flaw in digital data lifecycle management. Instead of properly purging user data, companies are simply renaming email addresses to placeholder strings like @deleteduser.com, effectively broadcasting private details to whoever owns that domain.

"I am being a good guardian of the internet dumpster—but if I had been a bad one, it’s not hard to see how this information could be misused." — Mike Sheward

The scale of the issue is immense. One researcher noted receiving thousands of CCTV stills from an AI company, demonstrating how even visual data is being leaked through automated error logs and notification systems.

Did You Know?: To prevent this, developers should use the .invalid top-level domain, which is officially reserved for testing and is guaranteed never to exist in the real world.

Frequently Asked Questions

1. How do companies end up sending data to these domains?
Automated systems are often programmed to send notifications to a user's email. If that user is deleted but their email is merely changed to a 'noreply' placeholder, the system continues to send sensitive data to that placeholder.

2. Is this a new phenomenon?
No, similar issues were reported nearly 20 years ago, but the scale has increased exponentially with the rise of complex AI and automated enterprise workflows.