My Stack Exchange profile has a specific e-mail address that I use on no other Internet site, and should be unguessable. My Developer Story is set to private. My profile has an uploaded image, not using Gravatar.

Despite having taken reasonable precautions to preserve my privacy, I received unsolicited commercial e-mail from connect@tibco.com on 2016-12-21 and js-noresponse@tibco.com on 2017-01-11. Both messages were advertising products and events to a general audience, not directed personally to me. They were also "profesionally" sent from the mail servers of a marketing firm called Marketo, with DKIM signatures from both s=m1; d=tibco.com and s=m1; d=mktdns.com.

How did they obtain my e-mail address? Has Stack Exchange been hacked or phished? Was there a rogue employee or moderator?

I believe that this is not a duplicate of…

  • I would ask tibco where they got the email from. – DavidPostill Jan 11 '17 at 18:45
  • I assume you're using Stack Exchange OpenID to log in? – Shadow Keeps Social Distance Jan 11 '17 at 18:48
  • @ShadowWizard Yes, I'm using Stack Exchange OpenID. – 200_success Jan 11 '17 at 18:48
  • There was a Developer Story leak, but it shouldn't have affected you since you set yours to private. – Laurel Jan 11 '17 at 19:58
  • Even if "moderator went rogue" as you define it and sold email addresses to spammers (very unlikely scenario, but who knows... we're all human) I don't think the team has any way to know/prove this. – Shadow Keeps Social Distance Jan 11 '17 at 20:03
  • @ShadowWizard Access to personally identifiable information by moderators is logged. Presumably, there would be a large batch of such accesses, if someone were harvesting any significant number of addresses. – 200_success Jan 11 '17 at 20:06
  • @200_success well, in theory such a rogue can just take few emails, of top selected users (you are, after all, #1 on Code Review), to not raise suspicion. But now with Shog's answer, that's even less likely the case. – Shadow Keeps Social Distance Jan 11 '17 at 20:16

Could've still been the Gravatar thing, if you were using that particular email with Gravatar back before we started salting them.

For several years, the hash that's used to generate the Gravatar image was published regularly in the data-dumps. We don't do that anymore - as your first related link states - but the data from those old dumps is still out there.

And of course, anyone who scraped the sites back in those days would've ended up with a whole bunch of email hashes too.

Hard to be sure about this, I'm afraid... But it's not impossible; a check of your account history suggests you used the default Gravatar image - with the hash associated with your email - until March of 2014.

| improve this answer | |

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .