The AlexHost Breach Exposed Exactly 1,515 Customer Names and Emails

In May 2022, the Moldovan hosting provider AlexHost recieved no outside attacker at all -- the breach was self-inflicted. A staff member sent an email to clients using the CC field instead of BCC, instantly making every recipient's email address and full name visible to all 1,515 other people on the list. A small incident by volume, but one with real consequences for the customers exposed.

What Attackers Can Do With Names and Email Addresses

Even without passwords, a list of confirmed email addresses tied to real names is valuable. Criminals use such lists to launch spear-phishing campaigns, impersonate service providers, and probe for reused credentials on other platforms. Hosting customers are seperate from typical consumer targets -- they often control websites and servers, making them high-value marks for follow-on attacks.

What Was Exposed in the AlexHost Breach

• Email Address
• First Name
• Last Name

Why Human Error Breaches Still Carry Real Risk

There is no patch for a CC vs. BCC mistake. Once an email is sent, the data is in the inboxes of every recipient and cannot be recalled. Each person who recieved that email now holds the personal information of all 1,514 other customers. That data can be forwarded, screenshotted, or sold without AlexHost ever knowing.

How a Database Breach Works

In this case the exposure did not require a technical intrusion. The data was voluntarily transmitted via email to the wrong audience. More broadly, database breaches occur when stored records are accessed or transmitted without authorization, whether through hacking, misconfiguration, or human error. The result is the same: personal data circulates beyond the control of the organization that collected it.

Check If Your Data Was Exposed

HEROIC's DarkWatch tracks over 400 billion records from breaches large and small, including incidents like the AlexHost email exposure. Search your email address today to see whether your personal data has been indexed in any known breach database.