One alias per platform. That is the whole answer, and the receipts are three of the largest leaks in history: Facebook gave up 533 million profiles, LinkedIn offered up 700 million, and Twitter spilled the addresses of more than 200 million users.
I run AliasFleet, an email-alias service: one forwarding address per site, so a leak names its source. We already made the general case for a different address on every website. This piece is about why social media deserves its own answer. A social account is not an order history. It is an identity record, and the identity record is the raw material every later attack is built from.
A social account is an identity record, not a shop
A shop leak hands the attacker your purchase history and your shoe size. A social leak hands them the record that ties your real name to your face to your phone number to your employer to everyone you know. Facebook, LinkedIn and Twitter are not databases of customers. They are databases of people.
So the email on a social account plays a different role than the email on a loyalty card. It is the primary key of the record, and in every one of these dumps it is also the join key: the field a buyer of the file uses to stitch your Facebook profile to your LinkedIn profile to the data broker's file on you. Run one address across all of them and you have handed every platform the same join key.
Three leaks, one playbook
April 2021. A file of 533 million Facebook profiles lands on a hacker forum. Facebook says it was scraped through the "contact importer" feature before September 2019, and that no passwords or financial data were in it. Almost every record had a mobile number, a Facebook ID, a name and a gender, according to BleepingComputer's look at the samples. The Irish regulator was not satisfied with the explanation: in November 2022 it fined Meta 265 million euros over the scrape, reporting that the contact importer tools were exploited between May 2018 and September 2019.
Two months later, LinkedIn's turn. 700 million profiles go up for sale in June 2021: over 90% of the platform's roughly 760 million users at the time, with fields ranging from names and emails to phone numbers, physical addresses, geolocation and inferred salaries. LinkedIn insisted this was not a breach at all, because the data was scraped rather than stolen from its systems (Computer Weekly's report). The seller, calling himself Tom Liner, told the BBC the same technique produced the Facebook 533 million dataset, and that he sold the LinkedIn data for around $5,000 (SecurityMagazine). LinkedIn's history makes it worse: 117 million email-and-password combinations from a 2012 breach were sold in 2016, and another 500 million profiles surfaced in a separate scrape in April 2021 (Cloudskope's timeline). Three exposure events in a decade, from one company.
Then Twitter, January 2023: a dataset of email addresses linked to more than 200 million users leaks on a hacker forum. Twitter denied the data came from exploiting its systems, but it had already confirmed a 5.4 million-user leak from an API vulnerability patched in January 2022, and Ireland's regulator had fined it 450,000 euros in 2020 for missing the 72-hour breach notification window (BleepingComputer). Troy Hunt noted that 98% of the email addresses in the Twitter dump were already sitting in Have I Been Pwned. One number, one shape of the problem: your address is not being leaked once. It is being leaked repeatedly.
"Data loss is data loss, and attackers will find the simplest way to obtain the data they need to fund their operations." Tim Mackey, Synopsys, on the LinkedIn scraping, quoted by Computer Weekly.
Every platform reaches for the same word: scraped, not breached. As if that comforts anyone holding the file.
Scraping is the business model
Here is the uncomfortable part. Nobody cracked Facebook's database. The 533 million records came from a feature that helped people find friends by uploading phone numbers, and the contact importer would gladly confirm which of those numbers belonged to a Facebook user. The LinkedIn 700 million came through the platform's own APIs, the same endpoints recruiters and sales tools hit every day. The platforms built machines for answering "who is this" at scale, and the attackers just asked at scale.
Scraping is not a flaw in the plan. It is the plan, used by the wrong people. So the "we fixed the specific issue" statements should not reassure you. Tom Liner's technique ran on LinkedIn for months before anyone noticed, and researchers say scrapers are nearly impossible to tell apart from legitimate API traffic. The next scrape of a major platform is a matter of when, not whether.
What the joined address buys the attacker
The leaked email does not sit in a drawer. It gets stitched to everything else. A Facebook record supplies the name, the face and the friend network. A LinkedIn record supplies the employer and the job title. Merge them on the shared email and the phishing profile writes itself: your name, your workplace, your phone number, delivered to the address you have had for a decade.
Three attacks follow from there. Credential stuffing first: the email is your username almost everywhere, so it goes straight into the stuffing lists. Then targeted phishing that quotes your own details back at you, because the dump has them. Then the exposure of anonymous accounts: PCWorld pointed out that the Twitter leak could unmask people who had been using the site anonymously, because their private email addresses were now tied to their handles.
Once you run per-platform aliases, a "security alert" that does not arrive on that platform's alias is fake by definition. A phish pretending to be Facebook that lands on any address other than your Facebook alias has outsourced its own detection. This is the mechanism from our leak-tracing piece, aimed at the phishing half of the problem.
The kill switch, in practice
The setup is simple: one email alias for Facebook, one for LinkedIn, one for X, one for every platform you use. Each forwards to the inbox you already open. No platform ever sees your real address, and no two platforms see the same address.
Now picture the morning after the next dump drops. You open your inbox and the phish and the spam are arriving on the Twitter alias. Nothing else in your life has ever used that address. No investigation needed, no guessing which breach it came from: the address names the source by itself. You pause the alias and the whole channel dies. Your real inbox never flinched.
Walk it through and the containment is airtight. The address in the dump belongs to Twitter and nothing else, so it cannot be joined to your LinkedIn record, because LinkedIn holds a different address. It cannot be stuffed into your bank's login page, because your bank never saw it. That is the mechanism the general piece covers in full, aimed at the accounts holding the richest identity data you own.
Where the alias stops helping
Four limits, stated plainly. A unique address per platform does nothing for a reused password. If your password is identical on Facebook and LinkedIn, the attacker does not need to chain anything. Pair the aliases with a password manager, or you have built half a system.
It does not un-leak the address you already handed out. The real address you used on Facebook for ten years is in the 2021 file, and nothing you do now pulls it back. Aliases stop the list growing. They do not shrink it.
Some platforms may reject alias addresses at signup. I have not verified every social platform's acceptance policy, so test each signup instead of assuming it works. One platform that needs the plain address does not cancel the protection on the rest.
And it does not encrypt your mail or hide the path it travelled. It changes the address a sender holds. Nothing else. For what aliases cannot do in general, the second-email piece argues a second inbox is the wrong tool and aliases are the right one.
Start with the next signup
Do not try to migrate everything today. That is not the work that matters: the old address is already out there, and retrofitting a decade of signups will not change that. The work that matters is the next signup.
Pick the next platform account you create, or the next one you touch for any reason, and hand it a fresh alias instead of your real address. The setup guide takes about two minutes. Send a test, watch it land, move on. Then run the HIBP check and walk the breach-response order of operations for whatever it finds.
The platforms will not stop being scraped. The only variable you control is what the scrape gets. Make it an address that belongs to that platform alone, with a switch you can flip.
Top comments (0)