I recently noted several incoming spam emails, which were sent to email addresses I exclusively used on Stack Exchange sites (StackOverflow.com and SuperUser.com)

I used different email addresses for those two sites, and I'm pretty sure I used the addresses on these sites only, never used them for anything else.

Is it possible that Stack Exchange leaked some user email addresses, which are now used by spammers?

  • 5
    What's your email address?
    – random
    Apr 1, 2017 at 14:24
  • 1
    You have an 8 year old stack overflow account. At one point, years ago, email hashes were included in the data dumps. Are you using the same address now as you did 8 years ago?
    – Andy
    Apr 1, 2017 at 14:26
  • 1
    @random - I've just checked their SO account and it's something that spammers could fairly easily construct.
    – ChrisF Mod
    Apr 1, 2017 at 14:27
  • Yes, it's the same address as years ago. What bothers me that I received only mails on addresses associated to my accounts. So if someone guessed, I suppose I should have received mails on other email accounts as well, which didn't happen
    – Bob
    Apr 1, 2017 at 14:31
  • 1
    Your Superuser and Stackoverflow accounts are merged. As point out email hashes were in data dumps, and Gravator had a problem also, you should chnage your email addresses
    – Ramhound
    Apr 1, 2017 at 16:13
  • Btw, as an aside, if your mail provider supports it (e.g. Gmail and many other large ones), you can append arbitrary tags to your email address with a "+" sign (e.g. [email protected] if your address is [email protected]). I do this as a rule so I can identify where spam sourced its email addresses from. It's not fool-proof, of course, spammers can strip the tags before sending, but it's caught a few issues in the past (not here, but in general). See also email subaddressing.
    – Jason C
    Apr 1, 2017 at 17:51
  • Note btw that the old Gravatar issue wasn't particularly tiny. If that were the source you certainly wouldn't be the only person that happened to. If you like your gravatar image, I'm pretty sure you can cut gravatar out of your chain in the future by downloading the image then reuploading it as an actual image, then changing your email.
    – Jason C
    Apr 1, 2017 at 17:54
  • You can also just regenerate it, that's what I did, and only mention that issue because it's an alternative explaination to what might have happened
    – Ramhound
    Apr 1, 2017 at 19:22
  • @JasonC I'm just doing that, that's how I found out where the emails could have been leaked.
    – Bob
    Apr 3, 2017 at 7:51
  • 2
    Possibly related.
    – Mithical
    Apr 3, 2017 at 7:56


You must log in to answer this question.

Browse other questions tagged .