threats

Address Harvesting

Updated October 16, 2026

Address harvesting is the collection of email addresses from public pages, documents, exposed data, or other sources to build contact lists. Attackers can use those lists for spam and targeted phishing. An exposed address is a targeting opportunity; it is not evidence that the mailbox has been compromised.

2 min. read

What do I need to know about Address Harvesting?

Public staff directories, event materials, and shared documents can reveal both addresses and job responsibilities.
Hiding an address with “at” or “dot” may deter simple scrapers, but it should not be treated as a security boundary.
An address alone does not grant mailbox access. Password reuse, deceptive login requests, and excessive permissions create separate risks.
Reduce unnecessary publication while keeping legitimate contact routes usable. A monitored role address can be more manageable than a personal mailbox.

An illustrative example

A school publishes a staff conference program. An attacker uses the listed finance contact to send a plausible invoice. The useful investigation question is not just “Where was the address found?” It is whether the request matches a real purchase, supplier, and payment process. This is an illustrative scenario, not a reported customer incident.

Practical checks

Inventory public contact information and remove outdated staff lists where practical.
Keep a simple reporting route for unexpected messages and investigate repeated targeting of exposed roles.
Protect the mailbox with strong authentication and verify sensitive requests through an established channel.

Five FAQs about Address Harvesting

Does receiving spam prove my email was hacked?

No. An address may have been scraped, guessed, purchased, or exposed elsewhere. Look for separate evidence of account access, such as unfamiliar sessions or unauthorized mailbox changes.

Is address harvesting the same as credential harvesting?

No. Address harvesting collects contact details. Credential harvesting tries to obtain passwords, authentication codes, or other login material. A harvested address may become the target of a later credential-phishing attempt.

Can a contact form prevent harvesting?

It can reduce the need to publish a personal address, but it does not guarantee privacy or prevent automated abuse. Protect the form itself and avoid exposing its destination unnecessarily.

Should we remove every employee address from our website?

Balance exposure against business needs. Public support or sales contacts may be necessary. Review sensitive roles, stale documents, and whether a role-based address can serve the same purpose.

What should we do after finding our addresses on a spam list?

Document the exposure, warn targeted teams about likely lures, and strengthen reporting and verification. Changing every address is rarely the first useful step; an exposed address does not itself establish account compromise.