What a Breach Does With Your Address

In short. The damage from a breach is rarely the breach itself. It is that your address is identical in every database it appears in, which lets separate leaks be joined into one profile of you. A throwaway address breaks that join and does nothing else, which is worth knowing precisely.

What actually comes out of a typical leak

Not usually the dramatic version. A normal dump contains the email address, a password hash, an account name, a registration date and an IP address. Sometimes a phone number. Sometimes a delivery address, if the site sold anything physical.

The password hash matters little when the site used a modern scheme and enormously when it did not, which is common on old forums and small shops running software nobody has updated in years. The address, by contrast, always comes out intact. It cannot be hashed, because the site needs to mail you.

That asymmetry is the point. Of everything in the dump, the address is the one field guaranteed to be readable, correct, and identical to the one in the next dump.

Why the address is the key rather than the payload

Anyone who collects leaked databases ends up with dozens of them, each with a different shape. Joining them requires a column that appears in all of them and identifies the same person across all of them. The email address is the only field that qualifies.

Once joined, the result is worth far more than the parts. One dump gives a forum handle from 2014, another a delivery address from a shop, a third a phone number and a birth date from a fitness app. Separately each is a fragment. Together they are a profile with your name, home address, phone, interests and a decade of history, assembled without breaking into anything new.

This is what people mean when they call an address an identifier. It is a join key, and it works because you reused it.

Credential stuffing, and what actually stops it

The second use of a leak is mechanical. Take every address and password pair from a breached forum, and try them against mail providers, shops and banks. A small fraction work, because a small fraction of people reused the password, and a small fraction of millions is a lot of accounts.

Note what defends against this and what does not. A unique password per site defends against it completely: the pair from the forum is useless everywhere else. A unique address per site does not, because the attacker is testing the address that leaked, on other services, and if you used that address only on the forum then there is nothing else to test.

The two habits therefore cover different attacks. Unique passwords stop credential stuffing, unique addresses stop the profile join, and doing one without the other leaves half the problem standing. If you only ever adopt one, make it unique passwords in a manager.

What happens, and roughly in what order

The timeline is fairly consistent, though the gaps between stages vary from days to years.

The data circulates privately first, among people who trade dumps, often long before the breached company knows or admits anything.

Then it is sold or published, which is when it enters bulk mailing lists. This is where the generic spam comes from, and it is the least harmful stage. Then it gets joined to other dumps, and the value multiplies.

Finally, for a subset of addresses, it is used for targeted phishing: messages that quote your real order number, your real delivery address or the real name of the service you used, because the sender has all of it. That last stage is the one that costs people money, and it is the reason a breach at a shop you forgot about matters years later.

What a disposable address changes

It breaks the join, and that is a genuine structural fix rather than a mitigation. An address used at exactly one site, which then stopped existing, cannot appear in a second database, so there is nothing to match. The dump containing it is worth less to whoever buys it, and the targeted phishing stage never reaches you, because the address it would be sent to is gone.

That is why throwaway addresses fit the places where you hand over an address to get one thing and expect nothing afterwards: a gated download or a webinar, a job board that resells your details to recruiters, or a device that demands an account before it will work. Those are exactly the sites whose security you have no way to assess and whose breaches you will hear about, if at all, in a news article three years later.

What it does not change

Everything else in the record. Your password, if you reused one. Your phone number, if the form asked. Your name and your delivery address, if you bought something physical. A throwaway address anonymises one field of a form you filled in truthfully, and the other fields identify you completely on their own.

It does nothing retroactively either. Changing the address on an account you registered five years ago does not remove the old one from a dump that circulated in 2021. The copy is made, and there is nobody to ask to delete it.

And it is the wrong tool where the site needs to reach you later. If a recruiter replies in three weeks to an address that expired in a day, the message is refused and nobody tells either of you. Worse, the address may have been reissued to somebody else, which is a whole mechanism of its own, covered in spam traps and recycled addresses.

What to do if your permanent address is already out there

Assume it is. Nearly every address that has existed for more than a few years appears in something.

Change passwords in order of what the account can do, not what leaked: mail first, because it resets everything else, then anything holding money, then anything holding identity documents, then the rest.

Turn on a second factor on the mail account specifically. That single step neutralises credential stuffing against the account that matters most.

Stop feeding the join. You cannot remove the address from existing dumps, but every new service that gets a fresh address instead of the old one is a record that will not connect to the rest.

Expect the phishing rather than the spam. Mail that knows a real detail about you is not proof of legitimacy, it is evidence that a database moved. When a message quotes an order and asks you to act, go to the site directly instead of following what is in front of you.

The uncomfortable conclusion

An email address cannot be recalled. No authority withdraws it from circulation, no request removes it from a file already copied to a hundred machines, and data that has left does not expire.

Everything practical therefore happens on the supply side: deciding, each time a form asks, whether this site is one you want holding a key that joins your records together. Most are not, and a throwaway address covers them. For the rest you are trusting somebody, and it is worth knowing that you are.