DEV Community: Ahsan Luqman

How Exposed Is My Email? Inside an Exposure Score

Ahsan Luqman — Fri, 13 Nov 2026 06:43:49 +0000

By Ahsan

An email exposure score is a single number that summarises the exposure of a user's alias fleet. AliasFleet computes the score from the telemetry of the fleet and presents it on a scale from 0 to 100, where 0 represents perfect privacy and higher numbers represent greater exposure. The score is a Pro feature, and it is accompanied by a breakdown of the inputs that produced it and a short explanation generated from those inputs. The number measures the alias fleet, and the destination inbox remains outside its scope.

Inputs

The breakdown behind the score contains eight fields, each drawn from the alias fleet and its inbound mail. The zombie count records aliases that remain active after the service they were created for has stopped being used. The spam ratio is the share of inbound mail classified as spam, expressed as a percentage. The identifiable alias count records aliases that contain the user's real name. The data broker correlation count records domains that correlate with data broker activity. The stale active count records aliases that remain active while unused.

The tracker count records tracking pixels stripped from forwarded mail. Two lists support the counts: the domains that send the most spam to the fleet, and the sender domains correlated with broker activity. Each field is a count or a share taken from the fleet itself, and the computation uses telemetry the service already holds rather than information supplied for the check.

Scoring

The score runs from 0 to 100, and lower numbers indicate less exposure, which reverses the direction of most security scores. A score of 20 or below carries the status Strong Privacy. A score from 21 to 45 carries the status Moderate Exposure. A score from 46 to 70 carries the status High Risk. A score above 70 carries the status Critical Exposure. The underlying risk level takes one of four values: low, moderate, high or critical.

The widget draws the number as a ring with the score as the filled arc, and it colours each band green, yellow, orange or red from the lowest band to the highest. A score above 20 displays the factors that contributed to it: broker correlations, zombie aliases and a spam ratio above 30 percent appear with a red marker, while real-name aliases and stale aliases appear with a yellow marker. A score of 20 or below displays the clean signals instead: zero broker correlations, no leaked or zombie aliases, and no real-name alias formats where the count is zero.

Regeneration

The score is computed on demand through a POST request to the exposure-score endpoint, which proxies the request to the scoring service. A request without a refresh flag returns the stored score, and a request with the refresh flag set recomputes it. Each recomputation consumes one unit of the account AI quota. The response carries the score, the risk level, the breakdown, a short explanation and the time of the last update, and the widget displays that time beside the scale. The feature is gated by subscription tier: Pro accounts receive the live score, while other accounts receive a preview card with a sample score of 15 and a list of the checks the full assessment would run.

Limits

The score measures only what the alias fleet and its mail can observe. When the fleet has received no mail, the spam ratio, the zombie count and the broker correlation count are all zero, and the widget states that it is awaiting email traffic to map behavioural risks. The score is also a snapshot: it carries the time of its last computation, and it moves as new mail arrives or as aliases are paused, rotated or removed. The inputs contain no credential or authentication factors, so the score says nothing about the strength of the passwords on the accounts behind the aliases or about whether two-factor authentication is enabled on the destination inbox. A low score records low values across the measured inputs, and the destination inbox remains a separate matter.

Other scoring systems

Exposure scoring is not unique to alias services. XposedOrNot runs a free breach search that returns a risk score for an address, and its index lists 835,955,029 exposed email addresses, with the most recent breach added on 9 November 2026. NordVPN also scores digital footprint exposure from 0 to 100, with 0 representing low exposure risk and 100 representing high exposure risk, and it draws on open-source intelligence and dark web monitoring. The difference between those systems and an alias fleet score is the source of the inputs: breach checkers measure an address against external breach records, while the alias score measures the behaviour of the fleet itself, including which aliases still receive mail and which senders dominate the spam. The two measurements draw on different inputs, and the alias score does not replace a breach lookup.

How to Protect Your Email for a Period Tracking App

Ahsan Luqman — Thu, 12 Nov 2026 00:00:00 +0000

A period tracking app keeps reproductive health data in an account that falls outside the main United States health privacy law, and named apps have passed that data to analytics and advertising firms. One managed alias per app, kept live while the app remains in use, keeps the account apart from the address used for banking and work.

What a period tracking app records

Cycle dates, symptoms, sexual activity, birth control and pregnancy status are the health detail a tracker records, next to an email address, a name, device identifiers and an IP address. The app turns that detail into predictions of the next period and the fertile window. Mozilla examined 25 reproductive health apps and wearable devices in 2022 and recorded the same combination, with email addresses, device IDs and advertising IDs held next to cycle length, date of last period, sexual activity and pregnancy due date. The Mozilla Foundation review carries the full findings.

On its own a cycle date reads as a calendar entry. Joined to an email address, a name and a device identifier, the same date becomes a record that identifies a person and states facts about that person's reproductive health. The companion guide on separate addresses for health and fitness apps covers the wider category.

HIPAA and personal health apps

Covered entities under HIPAA are health plans, most health care providers and health care clearinghouses, plus their business associates. A tracker downloaded from an app store for personal use is generally none of those. HHS puts the position in plain terms in its guidance on personal phones: "The HIPAA Rules generally do not protect the privacy or security of your health information when it is accessed through or stored on your personal cell phones or tablets." The same guidance leaves unprotected data downloaded or entered into mobile apps for personal use, unless the app comes from a covered entity or its business associate. The HHS guidance carries the full statement.

Information collected by a device or app may be viewed by other entities, used to send specific ads, or sold to a data broker, HHS adds. The FTC Act and the FTC Health Breach Notification Rule cover the gap instead. A final rule effective 29 July 2024 extended the Rule to developers of health apps and counts an unauthorised disclosure as a breach of security. The Federal Register carries the amendment text.

Documented sharing of health data

The record rests on three enforcement cases, each turning on the same pattern: health data reached analytics and advertising firms despite privacy promises.

On 17 September 2020 Glow settled with the California Attorney General, agreeing to pay a $250,000 civil penalty over alleged failures to protect users' personal and health information. Information was shared without authorisation through a partner-connect feature, and a password-change flaw allowed anyone to reset a user's password. Wyrick Robbins' account describes the case.

On 13 January 2021 the FTC announced a settlement with Flo Health, whose period and fertility tracking app was used by more than 100 million consumers. The complaint alleged that Flo promised users their health data would stay private, then sent health data from millions of users, including whether a user was pregnant, to five outside firms as "app events": Facebook's analytics division, Google's analytics division, Google's Fabric service, AppsFlyer and Flurry. The practice ended only after a February 2019 news article exposed it and hundreds of users complained. Under the settlement Flo must obtain user consent before sharing health information and undergo an independent privacy review. The FTC press release gives the full account.

The same pattern appeared at Premom two years later. On 17 May 2023 the FTC charged Easy Healthcare, the operator of Premom, with passing sensitive health data to AppsFlyer and Google through software development kits, and precise geolocation to two China-based analytics firms, Umeng and Jiguang. A $100,000 civil penalty, a permanent bar on sharing health data for advertising, and a further $100,000 to Connecticut, the District of Columbia and Oregon were in the proposed order. It was the FTC's second enforcement action under the Health Breach Notification Rule. The FTC press release has the details.

Mozilla's review of the category, published 17 August 2022, found the problem went beyond the three named apps. Of the 25 apps and devices reviewed, 18 received a Privacy Not Included warning, and eight failed to meet Mozilla's Minimum Security Standards. A class action, Frasco v. Flo Health, was filed in 2021, and a settlement of nearly $60 million was reported in September 2025. Flo denies liability and settled during the jury trial, so no verdict exists on its conduct; a jury did find Meta liable for violating the California Invasion of Privacy Act. Ifrah Law's account of the reported settlement describes it.

Law enforcement access after Dobbs

Dobbs v. Jackson Women's Health Organization was decided by the US Supreme Court on 24 June 2022, overturning Roe v. Wade. Almost eight weeks later Mozilla published its review, raising the concern that app data could be used by authorities to determine whether users were pregnant or seeking abortion services.

Access in law is narrower than the concern. A legal analysis published by the Cincinnati Bar Association notes that no reported cases existed of law enforcement requesting period app data in an abortion prosecution, and that a request to a third party company needs only a subpoena, while a request to the individual directly needs a warrant. The Cincinnati Bar Association article carries the analysis.

An alias leaves that position untouched. A subpoena served on the app company reaches the account record, and the alias forms part of that record. Only the identifier changes: the company holds the alias rather than the address used for banking and work, so the account cannot be linked to those accounts by email alone. What an alias provides is isolation of one channel; it is not a barrier to legal process.

The email address in a tracking account

The signup address also becomes the channel for the marketing mail that follows. When a tracker shares data with an analytics or advertising partner, mail arriving later on that address cannot be traced to its source unless the address belonged to one app only. A distinct alias per app makes the source visible in the address itself, the same attribution mechanism described in the guide to one alias per website. The guide on protecting email when booking medical care sets out the same separation method for a different channel.

At signup the email address becomes two things at once: the contact and recovery route for the account, and the key the app company and its analytics partners use to join the account to other records. One address shared across a tracker, a bank and a workplace account means a breach at any one of them hands the same identifier to whoever holds the file.

One alias per tracking app

One alias goes to each tracker, created before signup and labelled with the app name. Mail on that alias belongs to that app alone, and any marketing mail arriving on it names its source. Closure of the alias comes only after the account itself has been closed or moved, once the app is no longer used.

While the app holds health history, its alias stays live. Closing the alias first breaks password resets and account recovery, so closure comes only after the account itself is closed.

Recovery through an alias works only while the alias stays in service and forwards to a controlled inbox, as set out in the guide on using an alias for account recovery.

A short-lived address does not fit an account holding health history, which needs an address that lasts as long as the account. A managed alias is a persistent forwarding address, not a throwaway inbox, as the guide on whether aliases are safe states.

A check on Have I Been Pwned identifies which address was exposed when an alias appears in breach data. The guide on checking whether an email was leaked walks through reading that result, and the guide on finding every account linked to an email address lists the accounts tied to the main address before any change is made.

App choice and data exposure

The choice of app determines what data the app collects and where that data goes, while the address determines only the channel for account mail. Flo released Anonymous Mode on 14 September 2022, a setting under which users access the app without a name, email address or technical identifiers being associated with their health data. Cloudflare's Oblivious HTTP system sits behind the setting. Flo's own announcement states the trade-off: once Anonymous Mode is activated, data cannot be recovered if the device is lost, changed or stolen. Flo's announcement is the source.

Some apps keep data on the device rather than in a company cloud. Euki stores data locally on the user's device and was the only app to earn Mozilla's "Best Of" place in the 2022 review. With no server copy to breach, share or hand over, at the cost of sync and recovery if the device is lost. The FTC's consumer guidance on apps and tracking recommends reviewing app permissions and opting out of personalised ads.

Which third parties receive data, and what the company does on a legal request, is stated in the privacy policy before signup. The cases above show a policy can promise privacy and still be followed by sharing, so the policy is read alongside the enforcement record. No claim is made here about the current practice of any named app.

Limits of an email alias

Nothing beyond the email channel is contained by an alias. Health data collection continues, the alias encrypts nothing, sharing under the app's policy continues, and an address already stored in a system is not removed. The company still holds the name, the cycle data and the usage history, and the account is not anonymous.

The address already given away is not fixed by the alias, and acceptance is not guaranteed: no verified count of alias acceptance at these apps was found.

AliasFleet and period tracking accounts

Managed email aliases from AliasFleet forward to a verified destination inbox. A distinct alias is created for each tracker and given at signup. Account mail for that app arrives through the alias, and replies route back through it, so the destination address stays out of the app's records. The alias can be paused or closed when the app is no longer used, without changing the destination inbox. How email aliases actually work describes the mechanism: the alias is a forwarding address under the user's control, not a separate inbox.

10 active aliases, 1 verified destination inbox, 3 managed subdomains and 100 MB of monthly forwarding bandwidth are covered by the free tier, per the pricing page. AliasFleet holds no health data and makes the account no more anonymous. A permanent real address used only for financial accounts stays with the bank account, and a tracker keeps its own alias.

Fullerton Health breach may have exposed workers' data

Ahsan Luqman — Thu, 12 Nov 2026 00:00:00 +0000

Unauthorised access to a server supporting Fullerton Health's Migrant Worker Primary Care Plan (PCP) programme in Singapore may have exposed the personal data of migrant workers, the healthcare provider confirmed. Discovery came on 31 October 2026, and the notice went up on the company's website on Monday 9 November 2026. Six categories of data may have been affected: full names, Foreign Identification Numbers (FIN), dates of birth, mobile phone numbers, email addresses and residential addresses. The company said no health or medical records and no personal financial information were involved. No victim count was given, so the scale of the incident is still unknown.

Chronology of the incident

On 31 October 2026, Fullerton Health became aware of the incident and activated its incident response protocols. Precautionary measures were implemented across the company's network to secure its systems while the investigation continued. Nine days passed before the notice appeared on the company's website, on Monday 9 November 2026. CNA, The Straits Times and the Malay Mail reported it the same week.

How the server was accessed has not been disclosed. No attack vector has been reported, no attacker has been named, and no motive has been stated. Neither has the company reported any confirmed external outflow of the data, nor any confirmed misuse of it. The notice says the data "may have been affected". Unauthorised access to the server is confirmed, while exfiltration of a defined set of records is not.

Services stayed up throughout. Fullerton Health said all its managed care services, healthcare services and facilities remained operational. It also said it is cooperating fully with the relevant authorities, and that investigations remain ongoing, with further updates to come as more verified information becomes available.

Data that may have been affected

Six categories of personal data may have been affected, according to the notice: full names, Foreign Identification Numbers, dates of birth, mobile phone numbers, email addresses and residential addresses. The same six categories appear in the reporting of all three outlets, and the company drew a clear line around what was not involved. The affected data contains no health or medical information, and no personal financial information.

A FIN number is a government-issued identifier for foreign residents in Singapore. It cannot be changed the way a password can. Combined with a full name, date of birth, mobile number, email address and home address, it gives an attacker enough material to build a convincing identity for phishing and fraud attempts. No single field opens an account on its own. Together, the fields let an attacker impersonate a worker to a bank, an employer, a government service or the worker themselves. A leaked address becomes the starting point for that kind of attack, because password resets and official notices flow through the inbox, as How an email address leads to identity theft explains.

The email address carries a second risk. An attacker reaches the worker through that address, and the worker's own accounts use it for recovery too. A phishing email sent to an address the worker gave to a healthcare programme, naming the worker and referencing the PCP programme, is far more convincing than a generic scam message. The pattern is described in How phishing uses a leaked email: the leaked details supply the personalisation, and the personalisation supplies the trust.

Migrant Worker Primary Care Plan

Eligible migrant workers in Singapore receive affordable primary healthcare through the PCP programme. The Ministry of Manpower (MOM) administers it, and employers must buy PCP coverage for certain work permit and S Pass holders, including workers in the construction, marine shipyard and process sectors. Because that coverage is mandatory, the affected population could be large even though no victim count has been given. The programme covers a defined and sizeable workforce, and the server held the personal details of workers enrolled through it.

Some of the people affected may need more help understanding how they have been affected and what precautionary steps they can take. The company acknowledged this. Guidance will form part of the notification process, the company said. It is taking steps to notify affected migrant workers, tell them about the incident, and point them to where they can seek further assistance. Some of those affected may face language barriers, limited familiarity with Singapore's data protection process, and dependence on employers for information about a programme their employer bought on their behalf.

Company response and regulatory action

The Personal Data Protection Commission was notified, a police report was lodged, and the Ministry of Manpower was contacted. CNA received confirmation from the PDPC that it is aware of the incident and is investigating, and a PDPC spokesperson confirmed the same to The Straits Times. The company said it is giving the relevant authorities its full cooperation.

The incident also appears limited to a specific standalone system supporting the PCP programme, the company said. That is the company's own assessment, qualified in the notice itself with the words "appears" and "at this time". According to the company, there is no evidence at this time that systems supporting other programmes, projects, clients or patients have been affected. What the ongoing investigation finds will decide whether that assessment holds. Further updates will follow from the company as more verified information becomes available.

In its statement, Fullerton Health said: "Protecting personal information is one of Fullerton Health's highest priorities and we deeply value the trust that our stakeholders have placed in us. We sincerely regret any concern or uncertainty this incident may have caused."

Precautionary measures for affected workers

Affected migrant workers are being notified directly by Fullerton Health, with guidance on precautionary measures included in that notification. A notification's guidance should be read first by any worker who receives one, because it will reflect what the company knows about which records were on the affected server.

The standard steps for a breach of this kind are straightforward, beyond the company guidance. Any email, text message or call that references the PCP programme, a FIN number or Fullerton Health details should be treated with caution. It should be verified through a channel the worker already trusts, rather than through a link or number in the message itself. The signs to look for are covered in How to check if an email is phishing: a sender address that does not match the organisation it claims to be from, pressure to act quickly, and requests for passwords or payment details.

A check of whether their email address appears in a known breach is also worth doing. That check is run by Have I Been Pwned, which explains what each result means. The incident has not been reported as listed in Have I Been Pwned yet, so a clean result would not prove an address was unaffected, because listing depends on the data being verified and loaded. A reused password should be changed on each account, starting with email, for workers who reuse the same password across accounts. A leaked email address combined with a reused password is the combination that opens accounts. Those steps are walked through in order in What to do when your email is in a data breach.

Your address is probably in this file. Check whether it is, do the password work above, and then fix the part you control: the address you hand out next time. One AliasFleet alias per service means the next leak can only point back to the service that leaked it. Founders Club is $7 a month, locked forever, instead of $12. Early members only.

Related Singapore disclosures

Several other Singapore breaches were reported in the same fortnight, and the Fullerton Health incident follows them. Telco M1 disclosed a breach on 30 October 2026. Telehealth provider Doctor Anywhere reported a leak of users' personal data, with clinical records not affected according to forensic specialists. Singapore Airlines said data relating to booking records was accessed in a breach involving software provider Amadeus. SPH Media said its systems were hit by cyberattacks, and food solutions provider SATS disclosed that Tappee, a school meal ordering application, had been affected by a cyber incident.

No reported evidence links these incidents to each other. Two of those incidents have coverage on this blog: the M1 data breach and the SPH Media data breach. The Amadeus incident behind the Singapore Airlines disclosure is covered in the Amadeus airlines data breach article.

State of the investigation

The investigation is ongoing, and the facts that would settle the scale of the incident have not been disclosed. How many workers were affected, how the server was accessed, whether the data left the company's systems, and whether any of the data has been misused: none of this has been stated by the company. More detail may come from the PDPC investigation, and further updates will follow from the company as more verified information becomes available. Until then, what is verified is the discovery date, the notice date, the six categories of data that may have been affected, the absence of health and financial data, and the regulatory notifications the company has made. A victim count is the next update worth watching for. It would turn an incident of unknown scale into a measured one. Any statement from the Ministry of Manpower is also awaited. The ministry administers the programme and has been contacted by both CNA and The Straits Times for more information.

How to Protect Your Email When Signing Up for Therapy

Ahsan Luqman — Thu, 12 Nov 2026 00:00:00 +0000

Protection for an email address at therapy signup takes the form of one alias per therapy platform, with the address on the clinical record left permanent. Session notes, intake answers and payment details sit behind the signup address, which ties those records to one named person. The Federal Trade Commission ordered BetterHelp to pay $7.8 million after it passed email addresses and health questionnaire answers to advertising platforms, and Cerebral reported 3,179,835 people affected when tracking pixels sent similar information to the same kind of recipient.

What a therapy account contains

The address supplied at signup acts as the identifier for the whole therapy record. Account confirmation, session reminders, messages from the therapist, billing receipts and password resets all run through it. The record behind it is a clinical record, and the address connects that record to one named person.

At signup the form takes a name, an email address, a date of birth and payment details, and the intake questionnaire asks about mental health history, current symptoms, medication and past treatment. In the BetterHelp case the Federal Trade Commission recorded that the company asked whether users had experienced depression or suicidal thoughts and whether they were taking any medications, together with the name, email address and birth date. Each session adds to the record: session notes, messages with the therapist, diagnosis information and the treatment plan. Therapy is an ongoing relationship rather than a single booking, so the record keeps growing for months or years, unlike the one-off booking covered in how to protect your email when booking medical care.

Email addresses and health information

An email address on its own is ordinary contact detail. Once it is joined to a therapy platform name, a session time and an intake answer, it becomes an identifier tied to mental health care. The HHS bulletin on tracking technologies states that individually identifiable health information collected on a regulated entity's website or mobile app generally is protected health information, and it lists an email address among the information that counts. A breach of a therapy platform therefore exposes an address already joined to a health fact.

Have I Been Pwned counts 1,051 pwned websites and 17,858,196,501 pwned addresses. The method for checking whether an address has appeared in a known breach is set out in how to check if your email was leaked.

The Cerebral pixel disclosure

Cerebral, a telehealth platform providing online therapy and medication management, reported to the HHS Office for Civil Rights breach portal that 3,179,835 people had their information exposed by tracking pixels from Google, Meta (Facebook) and TikTok, which had run on its platforms from 12 October 2019. On 3 January 2023 Cerebral determined that it had disclosed information that may be regulated as protected health information under HIPAA to third-party platforms and some subcontractors without HIPAA-required assurances. The figures are reported in the Fierce Healthcare account of the Cerebral disclosure and the TechTarget account.

The disclosed data included an account holder's name, phone number, email address, date of birth, IP address and client ID number, assessment responses for anyone who completed the mental health self-assessment, and appointment dates, treatment and insurance information for subscribers. Cerebral stated that no Social Security numbers, credit card information or bank account information were disclosed.

Cerebral's own notice was not directly readable during research for this article, as its PDF returned an error when fetched. The figures in this section therefore come from the HHS portal reporting and the two independent reports quoted above.

The BetterHelp order

The enforcement action concerns BetterHelp. On 2 March 2023 the Federal Trade Commission announced a proposed order banning BetterHelp from sharing consumers' health data, including sensitive information about mental health challenges, for advertising, and requiring the company to pay $7.8 million to consumers. The order was reported as finalised in July 2023.

According to the FTC press release, BetterHelp revealed consumers' email addresses, IP addresses and health questionnaire information to Facebook, Snapchat, Criteo and Pinterest for advertising, after promising to keep such data private. The address itself was the mechanism. BetterHelp used consumers' email addresses and the fact that they had previously been in therapy to instruct Facebook to identify similar consumers and target them with advertisements.

The complaint states that between 2017 and 2018 BetterHelp uploaded lists of over 7 million visitors' and users' email addresses to Facebook, which matched over 4 million of them to Facebook user accounts. In January 2019 the company disclosed IP addresses and email addresses of approximately 5.6 million visitors to Snapchat. The full terms are set out in the FTC consent order.

The $7.8 million funds partial refunds to consumers who signed up for and paid for BetterHelp's services between 1 August 2017 and 31 December 2020. The order also bans BetterHelp from disclosing health information for advertising. BetterHelp settled without admitting wrongdoing and stated that the practices were industry-standard and had stopped in 2020. In each of the two cases the address gave the advertising platform a match key to an account it already held, and the health information arrived attached to it.

How the address leaves the therapy platform

The address given at signup does not stay inside the therapy platform by default: it moves under the platform's privacy policy, which differs between the health care side and the consumer side of the same company. The current Talkspace privacy policy, last updated 17 July 2025, states that an email address is collected when an account is created. Talkspace may also disclose personal data to service providers for advertising, marketing and analytics. Disclosure to business partners covers personalised advertising, including advertising technology vendors and social media platforms. Its US state privacy notice states that once a person becomes a patient and uses the portal, Talkspace does not engage in sales, sharing or targeted advertising.

BetterHelp's own Notice of Privacy Practices draws a similar line. Protected health information is collected at signup and payment, according to the notice, and written authorisation is required before use or disclosure of PHI for marketing or sale of PHI. The notice applies to the provider group delivering therapy, while a separate privacy policy covers the subscription offering.

On 1 December 2022 the HHS Office for Civil Rights issued a bulletin stating that regulated entities must not use tracking technologies in ways that result in impermissible disclosures of protected health information, and that disclosures of PHI to tracking technology vendors for marketing purposes, without HIPAA-compliant authorisations, are impermissible disclosures. The TechTarget account of the bulletin records that the bulletin followed reports of patient data reaching Facebook through tracking technology on hospital websites and inside password-protected patient portals.

A separate alias for each platform

Each therapy platform receives a distinct alias, created in advance and labelled with the platform name. The guide to setting up an email alias and the explanation of what an email alias is describe the setup. Session reminders, billing mail and follow-up mail for that platform arrive through the alias and forward to the real inbox, so nothing about the care itself changes. When marketing mail starts on the same alias, the source is visible in the address itself. When the care relationship ends, the alias can be closed without touching mail from any other platform.

The therapy case adds duration. Session reminders, billing mail and clinical messages keep arriving for as long as care continues, so the alias has to stay alive for months or years. The same preparation applies to protecting an email address when signing up for an online pharmacy, where the address links to prescription records. The wider enforcement record for health apps is set out in whether to use a separate email for health and fitness apps.

The alias during care

The alias stays alive for the life of the care relationship. Session reminders, billing mail and messages from the therapist may still arrive on it months after signup, and a missed session reminder or a missed billing message is a care problem, not only an inbox problem. The alias therefore stays in place until the care relationship ends and the account is closed properly.

The alias is the account address, not anonymity from the therapist. The therapist still knows who the patient is, because the patient gives a name, a date of birth and payment details at signup, and the clinical record holds those details whatever address was used. The clinical record keeps its own permanent address for the medical record, account recovery, identity checks and clinical communication, and the alias must never replace that address.

In this arrangement the alias keeps the address out of the advertising and analytics systems around the therapy platform, and keeps the therapy mail stream separate from the address used for banking, work and personal mail. The recovery position is set out in whether an email alias can be used for account recovery.

Forged mail after a therapy data exposure

A therapy data exposure can be followed by forged mail, because the disclosure leaves the address and the platform name known. The forged message knows the platform name, the timing of the real notice and the kind of mail the person expects, so reading the message does not expose the forgery. The mechanism is set out in how phishing uses a leaked email: after a leak, the mail stops guessing, and the To line becomes the test. A message claiming to be from the therapy platform, arriving on the alias given to that platform, is plausible. The same message arriving on any other alias is forged by definition, because the therapy platform never held that address.

The check that exposes most forgeries is set out in how to check if an email is phishing: a character-by-character reading of the sender domain, hovering over every link to see where it really points, and questioning the ask. The order of operations after a breach is set out in what to do when your email is in a data breach.

What an alias does not do

An alias does not stop a therapy platform collecting health data. The platform still receives the intake answers, session notes and payment details entered at signup and during care. It does not make the person anonymous to the platform, it does not remove data already shared or sold, and it does not encrypt the mail. An alias controls the handover of the address, nothing else. The mechanism is described in how email aliases actually work: the alias is a forwarding address under the person's control, not a separate inbox, and replies route back through the alias so the destination address stays out of the platform's records.

No verified count of therapy platforms that reject alias addresses at signup was found for this article. Some platforms may refuse an alias domain. The gap is stated here rather than filled with a guess. An alias also does not replace checking what was already exposed. An address used for therapy signups for years stays in past mail, and a breach check establishes what already happened before the alias system limits what happens next.

AliasFleet in therapy signup

AliasFleet provides email aliases that forward to a verified destination inbox. A distinct alias is created for each therapy platform, labelled with the platform name and given at signup, and session reminders, billing mail and follow-up mail arrive through it, with replies routing back through it. The alias can be paused or closed when the care relationship ends, without changing the destination inbox address. The free tier includes 10 active aliases, 1 verified destination inbox and 3 managed subdomains. Monthly forwarding bandwidth is 100 MB, as listed on the AliasFleet pricing page. AliasFleet does not hold the clinical record, and it does not replace the therapy platform: the permanent address on the clinical record stays in place, and the alias covers signup, session and billing mail only.

Is Mailfence Safe? Its Encryption Is Opt-In, Not Default

Ahsan Luqman — Thu, 12 Nov 2026 00:00:00 +0000

Mailfence is a Belgian email service run by ContactOffice Group SA, and the safety question has two answers. OpenPGP-encrypted mail cannot be read by Mailfence, because the browser does the encryption and the decryption, and the private key is stored on Mailfence servers encrypted with the account holder passphrase, with Mailfence holding no root key. Mail that goes out without that step remains readable on Mailfence servers in Belgium, where a valid Belgian court order can force its disclosure. The record shows this happening: 21 requests arrived in the second half of 2025, and 9 were complied with.

The claim and the default state

The private email page says that no one can read encrypted emails, not even Mailfence, because the browser encrypts each message and only the intended recipient decrypts it. The wording is accurate, and one word sets its boundary: encrypted. It describes mail that has been encrypted, and it covers nothing else in the account.

Nothing encrypts by default. A new account sends ordinary mail until the holder configures OpenPGP, creates or imports a key pair, and then picks the encrypted option message by message. The two choices appear side by side at send time in webmail, encrypted or in the clear. A critique of the claim puts it plainly: the promise is technically correct, and it depends on a manual setup that, the critique claims without a source, most account holders never finish. The percentage in that critique comes with no source. The setup mechanism itself is confirmed by Mailfence documentation.

OpenPGP encryption

OpenPGP is the encryption standard behind the claim. It is defined in RFC 4880 of November 2007, which specifies public-key and symmetric cryptography for confidentiality, key management, authentication and digital signatures. The service includes a built-in keystore, so generating and managing keys needs no third-party add-on. A key pair can be created inside Mailfence or imported from another tool. Several key pairs can be held at once, and a message can carry a signature so the recipient can verify where it came from.

The browser is where key generation happens. The private key is encrypted locally with the account holder passphrase before it crosses the network, according to an independent review. Mailfence states that the stored private key is encrypted with the account holder passphrase using AES-256. The unencrypted private key never appears on Mailfence servers, and Mailfence holds no root key. Under that design, the provider cannot quietly read encrypted mail, and the keys also stay portable, so keys and messages can be exported and used with any OpenPGP tool. In its comparison with Tuta, Mailfence notes that OpenPGP mail can be exchanged with any OpenPGP user. Tuta uses a proprietary format and does not support OpenPGP, so encrypted mail cannot leave the Tuta system.

OpenPGP on Mailfence has the same limits as OpenPGP anywhere, because both sides must use it for a message to be end-to-end encrypted. A message from Mailfence to a Gmail address travels under TLS, but the recipient holds no PGP key, so it is not end-to-end encrypted. The private key is protected by a passphrase. If the passphrase and the key backup are both lost, the encrypted mail cannot be recovered, by the account holder or by Mailfence. Client-side keys remove the provider's ability to read the mail, and with it the provider's ability to rescue it.

Unencrypted mail

Without OpenPGP, a message travels under TLS and has no further protection once it arrives. The secure email page states that all connections use TLS encryption, with Perfect Forward Secrecy on HTTPS connections and HSTS on all web pages. Inbound mail is validated with SPF and DKIM. This is baseline practice across the industry, not a feature particular to Mailfence.

Once a message reaches Mailfence servers, TLS stops applying. The body is then stored in a form Mailfence can read. The Mailfence security analysis describes the split directly. Bodies and attachments encrypted end to end are encrypted in storage with OpenPGP, and the web server does not know them. Sent and draft items are the exception. Message headers in storage are not encrypted at all. Subject lines, sender and recipient addresses, and timestamps sit unencrypted even for mail that is otherwise protected. The analysis also lists the standard limits of browser-based encryption, including false code served in a man-in-the-middle attack and access to the account holder computer.

Property	OpenPGP-encrypted mail	Mail sent without encryption
Message body readable by Mailfence	No	Yes
Subject, sender, recipient and timestamps readable	Yes	Yes
Protection in transit	TLS plus OpenPGP	TLS only
Body readable by Mailfence after disclosure	No, stays encrypted	Yes

Data collection

A long list of items appears in the Mailfence privacy policy: IP addresses, message-IDs, sender and recipient addresses, subjects, browser versions, countries and timestamps. Automatic anti-spam, anti-virus and anti-abuse checks run over incoming and outgoing messages. Some card details remain stored after credit card payments. Registration asks for an external email address, used for the activation code and for contact if the account cannot be accessed.

The same policy sets out what does not happen to that data. Mailfence does not sell, trade or transfer personally identifiable information to outside parties, except when forced by Belgian law. It does not use Google Analytics trackers. Messages, calendar entries, contacts and documents feed a search index, but the policy states that no information from that index is used to compile profiles of users. Technical and organisational measures behind that position are listed on the GDPR page.

The policy also states retention periods. Backups of deleted messages and documents are kept for 45 days, then permanently deleted. After an account is closed, all data is permanently deleted 30 days after the legal expiration date. Belgian law sets that date at 365 days after account closing. The policy was last updated on 21 December 2021, more than four years before November 2026, and may not reflect current practice in full.

Belgian jurisdiction and the transparency report

ContactOffice Group SA launched Mailfence in November 2013. The company has run hosted collaboration software since 1999, according to CyberInsider. Mailfence is provided by the Belgian company ContactOffice Group SA and falls under Belgian law. Mailfence states that Belgium has no equivalent to the US National Security Letter or gag order, so the company cannot be forced to act without being allowed to disclose it. The company also states that it does not disclose information directly to law enforcement agencies outside Belgium.

Belgian courts can compel disclosure, and Mailfence complies when they do. The transparency report gives the numbers. From 1 July 2025 to 31 December 2025, Mailfence received requests for user identification in 21 cases and complied in 9, under valid Belgian court orders. From the launch of Mailfence to 30 June 2025, it received 228 such requests and complied in 105 cases. Only legally binding requests from Belgian courts are counted. Unofficial requests are always rejected and not counted.

The transparency page was last updated in January 2026, with the next update due in July 2026. As read in November 2026, it still shows the July to December 2025 period. The figures describe the past, not the present.

The same page carries a warrant canary. It states that Mailfence has never received US National Security Letters or FISA court orders, and has never placed backdoors in hardware or software.

The sources do not settle whether Belgium imposes a data-retention obligation on email providers. One review states that there is none. CyberInsider reports that the 2016 retention law was declared unconstitutional on 22 April 2021. The privacy policy lists the metadata collected without citing a retention law as the reason, so retention-law logging remains unverified. Belgium is also a member of the Fourteen Eyes alliance, which CyberInsider notes as a drawback.

Password-encrypted messages

A second encrypted option exists for recipients who do not use PGP. The sender and recipient agree a password, which encrypts the message, and the recipient follows a link to decrypt it on Mailfence servers. The decryption takes place on Mailfence servers, not in the recipient browser. Mailfence therefore has the technical ability to decrypt these messages. The protection is not end-to-end encryption in the sense that OpenPGP is, and that follows from Mailfence's own wording. The Substack critique makes this point.

Pricing and plans

The free plan provides 500 MB of email storage and 500 MB of document storage, according to the Mailfence comparison of free providers. IMAP and POP access come with paid plans only. Paid plans start at 2.50 EUR per month. The free plan is thin for a primary mailbox, because 500 MB of storage fills quickly and, without IMAP, the account must be used in webmail or the mobile app.

The FAQ states that 15 percent of Ultra plan revenues go to the Electronic Frontier Foundation and European Digital Rights. Subscriptions are not refunded, because the free plan allows testing before upgrading. Payment options are credit card, Bitcoin, Litecoin, PayPal and wire transfer, and a free account is suspended after 7 months of inactivity and deleted 5 months later. The pricing figures in this section come from the Mailfence blog, because the pricing page returned 404.

The code is not open source. CyberInsider lists closed code as a drawback, because the encryption implementation cannot be inspected by the public. Mailfence states that its code is open to audits by recognised security experts, but no audit report was found or verified.

Mailfence and Posteo

Is Posteo Safe? is the closest published comparison on this site. It covers a German service with the same opt-in encryption shape and a different data model. Posteo collects no personal data at signup and logs no IP addresses, while Mailfence collects IP addresses, subjects and timestamps, and both services still differ sharply in what they record despite both offering OpenPGP.

AliasFleet and the Mailfence inbox

AliasFleet provides managed, persistent forwarding addresses, and a Mailfence account can sit behind them as the destination inbox. Mail sent to an alias forwards to the Mailfence address, and replies travel back through the alias. Websites never receive the Mailfence address itself. The free plan from AliasFleet includes 10 active aliases. The alias layer changes what is exposed, not what Mailfence can read. Mail forwarded to Mailfence is still mail held by Mailfence, and the encryption split described above still applies to it. An alias keeps the Mailfence address out of circulation. It also lets the account holder cut off a single alias when a service leaks it, as described in How Email Aliases Actually Work. Banking follows the same separation: a bank account uses a permanent real address kept only for financial accounts, as described in Should You Use a Separate Email for Banking.

Summary of the findings

The OpenPGP implementation is real, standards-based, client-side and portable. The transparency report runs on a six-month cycle, and its figures show real compliance with Belgian court orders. Encryption has to be switched on, per message, by an account holder who has set up keys. The other party has to use PGP as well. Until both steps happen, the mail is TLS mail on Belgian servers, with headers stored unencrypted and metadata collected under a privacy policy last updated on 21 December 2021. The wider question of provider access is covered in Can My Email Provider Read My Emails, and the check for an address already in a breach is covered in How to Check If Your Email Was Leaked.

Is Runbox Safe? Norwegian Privacy, Readable Mail

Ahsan Luqman — Thu, 12 Nov 2026 00:00:00 +0000

Runbox is a paid email service run by Runbox Solutions AS from Oslo, Norway. The service has operated since 2000, keeps mail on servers the company owns in Oslo, and bases its protection on Norwegian law and the GDPR rather than on encryption of stored mail. Connections to Runbox use TLS with Perfect Forward Secrecy, stored data carries full-disk encryption, and no end-to-end encryption applies by default, so the operator can read stored mail.

The two sides of the service sit far apart. Sign-in controls are thorough, the bar for disclosure is high, and the published request figures are small. Stored mail is readable by the operator at the same time, no published date exists for account-level encryption, and no published independent security audit was found. Strong sign-in controls and a high disclosure bar stand beside readable stored mail, no published audit, and no encryption date.

Company background

An independent review dates the start of Runbox to August 2000, when the service offered 100 MB of storage without charge. Runbox gives its own operating history as more than 25 years and counts 26 years on its comparison page. The company is independent and employee owned, with no venture capital. Its homepage gives the scale as over 1 million accounts served and customers in over 170 countries, both figures being the company's own claims.

Mail sits on servers Runbox owns inside a maximum security data centre in Oslo. The data centre was originally constructed for the Norwegian Government Computer Centre. The centre runs on 100 percent renewable energy, mainly Norwegian hydropower, and describes its operations as carbon negative through double offsetting. Ethical Consumer has named Runbox a Best Buy in each year since 2020.

Norwegian law and jurisdiction

Norway belongs to the European Economic Area, and the GDPR applies there through the Norwegian Personal Data Act. Enforcement belongs to the Norwegian Data Protection Authority, Datatilsynet, which began work on 1 January 1980 and ranks among the oldest data protection agencies in the world. Runbox records that it collects only the data needed to run the service, that Norwegian law does not ordinarily require it to retain traffic logs, and that it deletes user data on request.

Disclosure turns on a court order. Runbox requires a Norwegian court order under the Norwegian Criminal Procedure Act before it gives information to the Norwegian police, and it applies the same test to requests from foreign authorities. A foreign request ordinarily passes through diplomatic channels and the Ministry of Justice before it reaches a Norwegian court. Runbox records that a subpoena, a warrant, or a request from a government or foreign agency does not suffice on its own. The same pages record that the company complies with legally valid requests where Norwegian law or its Terms of Service have clearly been broken, so the court order rule sets a high bar rather than a refusal to cooperate in all cases.

The United States CLOUD Act

The United States CLOUD Act of 2018 allows United States authorities to compel a United States company, or a company using infrastructure under United States control, to hand over user data wherever the data is stored. Runbox records that the Act does not apply to the service, because the company is Norwegian, owns its servers in Oslo, and uses no infrastructure under United States control. Its business pages add that GDPR Article 48 restricts transfers of personal data to authorities outside the European Union. The position rests on server ownership and location, and it is the company's legal position, not a point settled by a court.

Norway belongs to the Nine Eyes intelligence-sharing arrangement, a point an independent review raises when it weighs Norway against Switzerland as a location for email. Runbox does not discuss the point on its own pages.

Mail protection in transit and at rest

Every connection to Runbox servers carries TLS with Perfect Forward Secrecy, and the servers carry full-disk encryption at rest. Full-disk encryption guards against a drive that is physically taken. It leaves stored mail readable by the operator, because the operator holds the keys. Runbox states the position plainly on its comparison page: account-level and end-to-end encryption are not offered by default yet, and platform upgrades are under way to prepare for them. No date is given for that work.

No published independent security audit of Runbox was found while this article was prepared, and no ISO 27001 certificate appeared on the company's primary pages. The absence of a published audit is a gap in public evidence, not a record of a failed audit.

Users can add end-to-end encryption themselves. PGP works in webmail through the Mailvelope browser extension, and S/MIME works through mail clients, with OpenPGP built into Thunderbird and native S/MIME support in Apple Mail. Runbox notes in its September comparison that end-to-end encryption holds in full only between users of the same system, and a message sent to a Gmail or Outlook address carries no end-to-end encryption unless keys have been exchanged. The comparison places Runbox beside Fastmail in the group without account-level encryption by default, while Proton and Tuta encrypt by default. Mail is therefore guarded in transit and at rest against outsiders, while the operator and a lawful order can still reach it.

Login and session protection

Two-factor authentication rests on TOTP codes from an authenticator app, with six-digit codes that change every 30 seconds. App passwords allow Outlook, Apple Mail, or Thunderbird to connect without the main account password. Trusted browsers, an unlock code held as a backup for two-factor authentication, per-protocol service toggles, IP-based access control, and active session monitoring complete the set, and session monitoring allows access to be inspected and revoked at any time.

Every provider in the comparison group offers some form of two-factor authentication, so it does not distinguish Runbox. The combination of app passwords, trusted browsers, an unlock code, and per-protocol toggles is the thorough part of the Runbox set. On IP addresses, an independent review lists the removal of IP addresses from outgoing messages as a benefit. Runbox does not state that on its own pages, so the claim belongs to the review and not to Runbox.

Advertising, tracking and server logs

Subscriptions fund the service in full. Runbox shows no advertisements, uses no third-party tracking tools and no web beacons, and records that it uses neither Google Analytics nor any other third-party tracking. Mail passes through scanning for virus and spam protection only, and the company records that it never scans messages for advertising, data mining, or sharing with third parties. The privacy policy records that the hosting provider and the ISP keep no logs of traffic to or from the Runbox servers.

Server logs for email delivery are kept for 10 days, and server logs for use of the web interface are kept for 1 month. The logs stay on the servers that run the service and go to no other company. The privacy policy records that incoming and outgoing mail may pass through automatic scanning for virus and spam protection, and that mail contents are indexed automatically to provide search. The policy page itself carries a 2018 date, while the privacy pages around it were updated during 2026.

Email content is kept for up to 6 months after a paid account closes and up to 1 month after a trial account closes, with immediate deletion available on request to support. Account information is kept for up to 5 years after closure, as Norwegian bookkeeping law requires. Backups of account content sit on separate secure servers for up to 6 months, even after the content has gone from main storage.

Disclosure requests and the transparency record

Runbox publishes a Transparency Report with figures for requests for disclosure of individual customer data received directly from authorities and others. The page stood up to date as of 9 September 2026 when this article was prepared. The figures are small.

Year	Norwegian requests	Foreign requests	Outcome
2026	0	1	1 complied with
2025	1	3	Norwegian request complied with; 1 foreign complied with, 2 rejected
2024	2	4	Both Norwegian complied with; 1 foreign complied with, 3 rejected

Few requests reach Runbox, and a share of the foreign requests are turned down, which supports the court order claim. The company still complies when the legal standard is met, including with the single foreign request in 2026, which matches its own statement that it is not a safe haven for criminal activity.

Plans and prices

Runbox has no free tier. A 30-day free trial comes with every plan, and a 60-day money-back guarantee applies to paid subscriptions. Six plans are listed by an independent review, because the official pricing page did not render content when checked for this article: Micro with 2 GB of mail storage at $19.95 per year, Mini with 10 GB at $34.95, Medium with 25 GB at $49.95, Max with 50 GB at $79.95, Max 100 with 100 GB at $119.95, and Max 250 with 250 GB at $179.95. Three-year plans are available at a discount, including for sub-accounts since October 2025.

Every plan includes 100 aliases on Runbox domains, unlimited aliases on the user's own domain, and unlimited plus-addressing, according to the Runbox help pages. All plans include calendar and contacts over CalDAV and CardDAV, file storage, and standard IMAP, POP, and SMTP access. The Runbox 7 webmail is open source and available on GitHub, while the rest of the service is not. Payment takes cards, PayPal, wire transfer, cryptocurrencies, and cash, according to the Runbox help pages. Runbox describes the model as email only, with no ads and no data mining, funded by subscriptions.

AliasFleet and Runbox

AliasFleet provides managed, persistent email aliases that forward to a destination inbox. Runbox serves as that destination inbox: forwarded mail arrives at the Runbox address, while the Runbox address itself is never given to websites or services. A leak or a spam run against one alias stays with that alias, and the Runbox address stays unexposed. Two-factor authentication codes can be received at an alias, so sign-in and recovery mail can also stay behind aliases. AliasFleet does not encrypt mail and does not replace the destination inbox; the Runbox account still holds the mail, and the limits set out above still apply to it. The separation between the address given out and the address that holds the mail is the point of pairing aliases with a provider such as Runbox. Have I Been Pwned checks whether an address has already appeared in a breach.

Runbox beside other providers

The same trust series covers Posteo, GMX, and iCloud, and Runbox differs from each in the same way: jurisdiction, rather than encryption, is the selling point. Posteo is a German provider with optional encrypted mailbox storage, and the Posteo piece turns on that option. GMX is a free ad-supported German service, and the GMX piece turns on the advertising model. iCloud Mail is tied to Apple accounts and Apple infrastructure, and the iCloud piece turns on that integration. Runbox is the provider in the series whose case rests on Norwegian law, a published transparency record, and a long operating history, with readable stored mail as the stated cost. Proton and Tuta encrypt by default. Those properties fit a reader who wants a stable paid inbox under strong privacy law and accepts the encryption limit. The Have I Been Pwned safety piece covers the breach-checking service named above in more detail.

ezTravel Breach Exposes 690,000 Customers' Email Data

Ahsan Luqman — Thu, 12 Nov 2026 00:00:00 +0000

The ezTravel data breach is the unauthorised access to booking information of more than 690,000 members of ezTravel, a Taiwanese online travel agency, disclosed by the company on 9 November 2026. The data that may have been exposed includes names, email addresses, phone numbers and purchase or order details from past bookings. Credit card numbers, card security codes, account passwords, passport numbers and national identification numbers were not involved, and payment processing was not affected. As of the end of 2025, the ezTravel app had been downloaded more than 4 million times and more than 70 percent of bookings were made through the app, according to Taiwan News, citing the Commercial Times.

Detection and disclosure

ezTravel detected unusual external network activity targeting its membership system on Saturday 7 November 2026 and blocked the suspicious traffic, according to the company's statement as reported by Focus Taiwan. The company released its statement on Monday 9 November, and the Taipei Times reported the same sequence of detection on Saturday and disclosure on Monday. The affected count of more than 690,000 was set after cross-checking records and removing duplicates, according to BreachNews, so the figure counts people rather than bookings or records. The activity targeted the membership system, the part of the platform that holds customer records, and payment processing was not affected.

Data exposed and data not exposed

The exposed data may include four fields: names, email addresses, phone numbers and purchase or order details from past bookings. ezTravel used the word "may" because the preliminary investigation had not established the full extent of what was taken, and the company described the information as improperly accessed rather than confirming exfiltration of every record. Names, email addresses, phone numbers and real order details are the material used for impersonation scams, and ezTravel warned customers about that risk.

Data type	Status in the breach
Names	May have been exposed
Email addresses	May have been exposed
Phone numbers	May have been exposed
Purchase and order details	May have been exposed
Credit card numbers	Not involved
Card security codes	Not involved
Account login passwords	Not involved
Passport numbers	Not involved
National identification numbers	Not involved

Investigation and official reporting

ezTravel apologised for the concern caused to consumers and pledged to safeguard customers' personal information, according to Focus Taiwan. The company hired an independent cybersecurity team to investigate the incident and conduct a digital forensic analysis, and it reported the incident to the relevant government agencies and police under Taiwan's personal data protection laws. The company did not name a threat group, describe an attack vector, or say how the attackers first reached the membership system. No attribution has been published. No confirmed misuse of the exposed data and no financial losses have been reported in the company's initial statement.

Notification and scam warnings

ezTravel notified affected customers by text message and email. The company warned that scammers might impersonate customer service or bank representatives to obtain credit card details or verification codes, or trick customers into using ATMs or clicking suspicious links, according to EconoTimes. The warning named specific tricks: fake customer service calls, bank staff impersonation, requests for verification codes, and ATM operations to cancel instalment payments. The company said it would never ask customers to disclose account passwords or verification codes, or to use ATMs to cancel instalment payments. BreachNews reported that official notifications about this incident do not include website links, according to local reporting of the company's guidance, so a message about this breach that contains a link is not an official notification. Customers with questions can call ezTravel's service line at 412-8001, adding 02 from a mobile phone, or Taiwan's 165 anti-fraud hotline.

Steps for affected members

Unexpected calls, texts or emails about ezTravel bookings should be treated with suspicion, even when the sender knows a real order detail. Card numbers and one-time verification codes should never be shared over those channels. The steps to take after an address appears in a breach are set out in what to do when your email is in a data breach. The exposed order details give phishing messages real material to work with: a message can name a real destination, a real travel date or a real booking reference. Those details do not show the message is genuine. The mechanics of that kind of attack are covered in how phishing uses a leaked email.

ezTravel said it will never ask customers to disclose account passwords or verification codes, or to use ATMs to cancel instalment payments. A call, text or email that asks for any of those is not from ezTravel.

Customers who want to know whether their address appears in known breaches can check with the method in which website leaked my email. Changing the ezTravel account password is a reasonable precaution even though passwords were not exposed, because the same password may be reused elsewhere, and customers who reused their ezTravel password on other services should change it on those services too. The question of whether a new email address is needed after a breach is answered in should you change your email after a data breach.

The wider pattern in Taiwan

Taiwan's Ministry of Digital Affairs (MODA) said on Wednesday 11 November 2026 that recent attacks on more than 10 businesses and platforms affected more than 1 million personal records, including names, phone numbers, email addresses and order details, according to Focus Taiwan. Ministry officials said preliminary investigations linked nearly half of the attacks to AI, and some attack traffic appeared to originate from Hong Kong. The wave began around mid-September, with the first cases reported in South Korea, and it was still ongoing when MODA spoke on 11 November. MODA declined to name the affected businesses. The companies named here come from their own disclosures, not from MODA: e-commerce service provider 91APP said up to 4.8 million consumers could have been affected, and ezTravel reported more than 690,000 affected members. MODA did not confirm whether either company was included in its tally of more than 1 million records, so the ezTravel figure should not be counted as part of that total.

What remains unknown

The investigation is still preliminary. The attack vector is undisclosed, no threat group has been named, and no attribution has been published. It is not known whether the data was exfiltrated or only accessed, or which records were confirmed exposed rather than suspected. No confirmed misuse of the exposed data has been reported, and no financial losses have been linked to the breach. No standalone English incident page from ezTravel was found, and the company has not said when the forensic investigation will conclude or whether a final report will be published. Further detail from ezTravel or MODA would change the picture.

How Conditional Email Routing Rules Work

Ahsan Luqman — Wed, 11 Nov 2026 06:43:13 +0000

By Ahsan

A conditional email routing rule is a server-side predicate that a mail forwarding service evaluates against each inbound message before delivery. The rule pairs a set of conditions on the message with a set of actions, and the service applies the actions when the conditions match. In AliasFleet, the rules engine intercepts an inbound transaction immediately after address resolution and evaluates the message against the account rule chain in priority order, as described in the Rules API reference.

Evaluation model

Rules run in sequence starting from priority 1, and each rule specifies a match type of ALL or ANY across one to five conditions. ALL requires every condition to hold, while ANY requires at least one. A rule carries one to five actions, and all of the actions run when the rule matches. Each rule also carries an optional stop_processing flag, and when a matched rule sets the flag, evaluation of lower-priority rules ends for that message. The flag gives the chain the same short-circuit behaviour found in other rule systems, where an early match makes later rules unreachable for that message.

Condition fields

The reference lists nineteen condition fields in five groups. Sender attributes cover the full sender address, the sender domain, the display name and the Reply-To address. Recipient attributes cover the alias address and domain, the lifetime forwarded count for the alias, whether the message arrived through a domain catch-all, and whether the spam classifier flagged the message. Content attributes cover the subject line, any named MIME header and the total message size in kilobytes. Attachment attributes cover the presence of attachments, file names and MIME types. Authentication attributes cover the SPF, DKIM and DMARC verdicts and the numeric Rspamd spam score. The score thresholds in the reference are below 5.0 for clean mail, 5.0 and above for suspected mail, and 10.0 and above for blocked mail.

Comparison operators

Thirteen comparison operators apply across the fields. String fields use is, is_not, contains, does_not_contain, starts_with, ends_with and matches_regex, with matching case-insensitive. Header fields also use exists and not_exists for presence tests. Numeric fields use greater_than, less_than, greater_than_or_equal, less_than_or_equal and is. A condition on the sender domain therefore reads as a comparison between a field and a value, and a condition on the spam score reads as a numeric comparison against a threshold, with the same operator set serving both kinds of field.

Actions

The reference lists sixteen action types in four groups. Transformation actions prepend or append text to the subject, replace the subject or the sender display name, and inject a custom header. Security actions strip tracking pixels and attachments, disable PGP encryption for the matched delivery, and set the position of the disclosure banner. Routing actions forward the message to a different verified destination, send an automatic reply, add the sender to the blocklist, and dispatch a JSON payload to a registered webhook endpoint. Terminal actions drop the message silently, with no forwarding and no bounce, or place it in quarantine for administrative review. The engine specification describes quarantine as AES-256-GCM encryption of the raw message into a vault for seven days, with inspection, release and discard handled in the application. The automatic reply follows RFC 3834, with loop protection and a recipient cooldown that defaults to 24 hours and ranges from 1 to 168 hours.

Plan limits

Rule counts depend on the subscription tier. The Free tier allows no rules, and an attempt to create one returns HTTP 403 with the code LIMIT_REACHED. The Pro tier allows 20 rules, and the Business tier allows an unlimited number. The limit is enforced at creation time, and deleting a rule releases its quota allocation.

Relation to other filtering systems

The condition-action shape is shared with older filtering systems. Sieve, the IETF mail filtering language defined in RFC 5228, expresses a rule as a set of tests on headers, envelope and size, combined with allof, anyof or not, followed by actions such as fileinto, redirect, discard and reject. Microsoft Exchange transport rules use the same three-part structure of conditions, actions and exceptions, and include a stop-processing option that ends evaluation of later rules, as described in the CodeTwo guide to Exchange transport rules. The difference between these systems and an alias forwarding service is the point of evaluation: mailbox filters run at delivery into a mailbox, while forwarding rules run at the forwarding service before the message reaches the destination inbox, so the actions available are forwarding, transformation and dropping rather than filing into folders.

Rules API

The rules are managed through the AliasFleet API under /v1/rules, with rules:read scope for listing and rules:write scope for creation, update, deletion and reordering. Endpoints accept a name of 1 to 120 characters, an optional description, a priority, a match type, the stop_processing flag, and arrays of one to five conditions and one to five actions. A separate reorder endpoint accepts an ordered array of rule identifiers and assigns priority from the array position. Requests are limited to 60 per minute.

How to Protect Your Email When Signing Up for a Carrier

Ahsan Luqman — Wed, 11 Nov 2026 00:00:00 +0000

A US mobile carrier account controls a phone number, and the number is the recovery path for email, banking and social accounts. The email address on the account is protected with one dedicated alias that stays active permanently, an app-based second factor instead of SMS codes, and the carrier number lock switched on at signup.

The carrier account and the phone number

A SIM swap moves the number onto a SIM card controlled by an attacker, and a port-out moves it to a different carrier under the attacker's control. The Federal Communications Commission defines a SIM swap as a bad actor convincing a carrier to transfer a victim's service to a phone in the attacker's possession. Once the number moves, calls and texts go to the attacker, including SMS verification codes for email, banking and social accounts.

The FBI Internet Crime Complaint Center recorded 982 SIM swap complaints and $25,983,946 in reported losses in the United States in 2024. An earlier FBI announcement, public service announcement I-020822-PSA, recorded 1,611 SIM swapping complaints in 2021 with adjusted losses of more than $68 million. Both sets of figures count only complaints made to the FBI, so the real total is higher.

SIM swap and port-out rules

The Federal Communications Commission adopted rules on SIM swap and port-out fraud on 15 November 2023, in Report and Order FCC 23-95. The rules require wireless providers to adopt secure methods of authenticating a customer before redirecting a phone number, to notify customers immediately whenever a SIM change or port-out request is made, and to offer customers the option to lock their accounts against SIM changes and number ports. The rules apply to wireless providers including resellers, for prepaid and postpaid customers. Carriers may not rely on readily available biographical information or account information as the secure method of authentication, so a date of birth or a billing address is not treated as a secret. The account PIN, the number lock and the second factor carry the weight instead of the personal details given at signup.

Secondary reports disagree on the compliance timing of individual provisions, so this article states the adoption date and the requirements without claiming a compliance date for every provision. The FCC's December 2023 enforcement advisory described the changes as not yet in effect, while later summaries give 8 January 2024 as the effective date, with some information-collection provisions held back pending Office of Management and Budget review.

The email address on the account

The email address given at carrier signup is a dedicated alias used for the carrier and for nothing else. One dedicated alias per carrier keeps the account isolated, so a breach at a shop, a forum or a streaming service cannot expose the address that recovers the carrier account. The pattern is the same one described in a separate email for every website, applied to the account where it matters most. The same permanence rule applies to account recovery: an alias used for recovery must still work when recovery is needed, years after signup.

A carrier account needs its email address for recovery for as long as the number exists. An alias that is deleted or allowed to lapse removes the recovery path for the number, so the carrier alias is kept alive for the life of the account.

The primary inbox behind the alias needs the same attention, because if it is protected only by SMS codes sent to the carrier number, a SIM swap breaks both at once. An address can be checked for past breaches at Have I Been Pwned before it is given to the carrier.

Number locks

Each major US carrier offers a free number lock, and the lock is switched on at signup. The names differ by carrier, but the function is the same: the lock blocks SIM changes and number transfers until the account holder switches it off. The locks are opt-in and must be switched on, so they only help when the account holder turns them on.

Carrier	Lock	Where it is switched on
T-Mobile	SIM Protection and Port Out Protection	T-Life app: Manage tab, gear icon, Security, SIM Protection; T-Mobile.com: Profile, Security, SIM Protection
Verizon	SIM Protection and Number Lock	My Verizon app or website, under Security settings
AT&T	Wireless Account Lock	AT&T app only; standalone tablet or hotspot locks are managed by contacting AT&T

T-Mobile offers two features. SIM Protection is a free feature for T-Mobile postpaid customers that prevents bad actors from moving a number to another device. Account Takeover Protection blocks unauthorised users from transferring lines to another wireless carrier, and it must be added to each line individually. Only the Primary Account Holder can remove SIM Protection. T-Mobile also requires an account PIN of 6 to 15 non-sequential numbers, which cannot be a date of birth or a Social Security number.

Verizon splits the protection into two toggles. Number Lock is free and prevents a mobile number from being moved to another carrier, and a locked number cannot generate a Number Transfer PIN. Verizon states plainly that Number Lock does not prevent SIM card changes or equipment changes, so SIM Protection is needed as well. A Number Transfer PIN expires after 7 days.

AT&T combines the protection into one switch: Wireless Account Lock is a free security feature. When the lock is switched on or off, AT&T sends a confirmation email to the account email address and a text message to the wireless device. Account holders outside the United States need their own carrier's equivalent lock, and carrier app menu paths change often, so the locations above are taken from the carriers' own support pages as opened on 2026-11-11.

A number lock depends on carrier staff following the verification procedure when an attacker calls or visits a store. In August 2019, attackers took control of Twitter chief executive Jack Dorsey's account after tricking his mobile provider into handing over his number, an incident Twitter attributed to a security oversight by the mobile provider. The lock reduces the risk and does not remove it, which is why the second factor must not depend on SMS.

The second factor

The second factor on the carrier account is app-based, never SMS-only. The Federal Trade Commission states that text message verification may not stop a SIM card swap, and recommends an authentication app or a security key for accounts with sensitive personal or financial information. The FTC's two-factor authentication guidance adds that an authenticator app is safer than a text message code because the passcode it generates is not susceptible to a SIM card swap attack, and that a security key is the strongest method.

An authenticator app generates codes on the device from a shared secret, so no code travels over the phone network and no number is involved. A SIM swap gives the attacker the number, but the app codes are generated on the owner's device and the attacker does not have them. NIST SP 800-63B-4 requires applications at Authentication Assurance Level 2 to offer a phishing-resistant authentication option. Some carrier steps still use SMS: AT&T sends a one-time code by SMS to validate switching Wireless Account Lock on or off, so where SMS is the only option for a particular step, the number lock and the account PIN carry the protection instead. The same rule applies to the email account behind the alias: two-factor authentication codes can be received at an email alias, but the codes are only as safe as the inbox they land in.

Alias rejection at signup

Some websites reject alias domains at signup, usually through a blocklist of domains associated with alias services or short-lived inboxes. AliasFleet's own article on alias detection states that some websites can detect an alias, usually from its domain, but that detection is not rejection, and that many detected aliases are accepted. No carrier-published policy was found stating that T-Mobile, Verizon or AT&T block alias domains at signup, and this article does not claim that any named carrier does so. If a carrier signup rejects the alias, the fallback is a permanent address on a domain the account holder controls, or a mainstream provider address kept only for the carrier account. The question of whether aliases are safe in general is covered in the AliasFleet guide on alias safety.

Recovery planning

Recovery planning is done at signup, while the account holder still controls the number and the inbox. The same pattern for another high-value account is described in the password-manager signup guide.

If a SIM swap happens, the FTC advises contacting the cellular service provider immediately to take back control of the phone number, then changing account passwords, checking bank and card accounts for unauthorised charges, and going to IdentityTheft.gov if Social Security, card or bank account numbers may have been stolen. The email account is secured first, because it is the route to every other account. The warning signs named by the FTC are a phone that suddenly stops working, or an unexpected notification that the SIM card has been activated on a new device.

AliasFleet and the carrier account

AliasFleet provides managed forwarding aliases, with one dedicated alias per service, forwarding to a verified destination inbox. A carrier alias forwards carrier mail to the primary inbox, and it can be paused or disabled if it starts receiving spam, without changing the primary inbox address. The free plan includes 10 active aliases, as listed on the pricing page.

AliasFleet does not stop a SIM swap. The number lock, the account PIN and the app-based second factor do that work, and they belong to the carrier. What AliasFleet does is keep the carrier account isolated from every other signup, so a breach elsewhere does not hand an attacker the address that recovers the number.

Measures at signup

At signup, one dedicated alias is created for the carrier account and used nowhere else, and it stays active for the life of the account. An app-based second factor, never SMS-only, protects both the primary inbox behind the alias and the carrier account itself. The carrier number lock is switched on at signup, in the carrier app or account settings, and an account PIN is set that is not a date of birth, a Social Security number or any other readily available personal detail. Backup or recovery codes for the email and carrier accounts are saved in a password manager or on paper in a safe place, with the authenticator app backed up or enrolled on a second device.

Can You Use an Email Alias for Steam? Yes, With One Catch

Ahsan Luqman — Wed, 11 Nov 2026 00:00:00 +0000

An email alias for Steam is a forwarding address used as the contact address on a Steam account. Steam accepts such an address at sign-up: the form asks for an email address, a country of residence and a CAPTCHA, then sends a verification email, and no phone number is required. The address then carries Steam Guard codes, password resets and trade confirmations for the life of the account.

Valve publishes no rule on alias addresses specifically. The sign-up page states that some email providers just do not work with Steam, and it recommends a different address when the verification email never arrives. Acceptance therefore turns on the provider and the domain behind the address, not on the address being an alias.

Account creation

Account creation starts at the Steam sign-up page, where the form asks for the email address twice, the country of residence, a CAPTCHA, and confirmation that the user is 13 or older and accepts the Steam Subscriber Agreement and the Valve Privacy Policy. A verification email follows, and the account name and password are chosen once the address is confirmed. Secria confirmed the same five fields, the email address entered twice, the country, the CAPTCHA and the age and terms confirmation, in its 5 November 2026 check, with no phone number field anywhere in the process, as reported by Secria. The account name is the sign-in name, separate from the email address and the community profile name.

The Steam Subscriber Agreement bars users under 13 and states that the account is strictly personal: it may not be sold, charged for, or transferred, and an account Valve notices has been sold will be permanently locked. The same email address can be used on more than one Steam account. ExpertBeacon reports that Steam Support states there is no limit to the number of Steam accounts that can use one email address. Games stay with the account that bought them, and deleting an account is permanent, with a 30-day window in which the owner can cancel the deletion request.

Domain reputation and alias acceptance

Steam checks that the address can receive its verification email, and it does not ask whether the address forwards to another inbox. A managed alias on a reputable domain therefore behaves like any other address at sign-up. The distinction that matters is between a managed alias and a short-lived address. TempMailBest, a provider of short-lived addresses, reports that some Steam beta sign-up forms reject known short-lived domains, and that its first domain may be blocked while an alternative domain works, as described in its guide to Steam beta access. TempMailBest addresses expire after 10 minutes, which makes them unsuitable for any account that needs mail later.

Third-party guides report that less common or newly created domains may be flagged, and that some email providers have blocked mail from Steam intermittently, according to Games Learning Society. The general pattern of services rejecting alias domains is covered in the AliasFleet guide on when a service will not accept an alias email: the domain's reputation decides, not the fact that the address is an alias. No verified user report was found of a named alias provider being accepted or rejected by Steam itself. Steam sends more than the one verification email: purchase receipts, security notifications, trade confirmations and password resets all go to the contact address over the life of the account, and an address that worked for sign-up and then stopped receiving mail leaves the account cut off from all of them.

Steam Guard and the contact email

Steam Guard is Valve's second layer of account security. It requires a code at sign-in from an unrecognised device, sent to the contact email address or generated by the Steam Guard Mobile Authenticator in the Steam Mobile App. Valve's Steam Guard FAQ states that Steam Guard is enabled by default on an account if the email is verified and Steam has been restarted twice on the computer since verification. The authenticator generates a code that changes every 30 seconds and can only be used once, and Valve describes the phone-based authenticator as the best level of Steam account security.

The email address matters because email Steam Guard is only as safe as the inbox behind it. Valve states the consequence directly:

If your verified email account is stolen or compromised, a user can enter your account freely provided they know your account name. Knowing your Steam account password would not be required as this can be reset with access to your email account.

Valve's Account Security Recommendations add that the Steam account password and the contact email password should be different, and that hijackers often target email accounts to reach other accounts, including Steam. An alias does not weaken this chain, provided the alias forwards reliably and the destination inbox is itself protected with a strong password and two-factor authentication. Two-factor codes at an alias are covered in the AliasFleet guide on receiving two-factor authentication codes at an email alias.

A check of the address on Have I Been Pwned shows whether it has appeared in a breach. The service lists 1,051 pwned websites and 17,858,196,501 pwned addresses, as shown on the Have I Been Pwned homepage on 11 November 2026. An alias limits the damage of a breach to the one service that received that alias, because the address is not shared with other accounts.

Trading and the Community Market

Trading and the Steam Community Market are tied to Steam Guard, not to the email address itself. Accounts without the Mobile Authenticator enabled for at least seven days have items held by Steam for up to 15 days when they leave the account, and email-only accounts cannot trade from a newly confirmed device for seven days. Accounts with Steam Guard turned off cannot trade or use the Market at all, as reported by UrbanWired from Valve's trading-restriction pages.

Changing the contact email is reported to trigger the same kind of restriction. Games Learning Society lists changing the email address among the security changes that can trigger the 15-day hold. This is a third-party report, and the Valve pages checked for this article do not state the hold length for an email change directly.

Account recovery

Steam Support's page on recovering a stolen or hijacked account states that recovery is possible even if someone has changed the account's email address, password and phone number. The same page asks the account holder to provide any possible email addresses used on the account, and the support form asks for the first email used on the account. A working alias helps recovery, because the alias is the address Steam has on file and the destination inbox is where the recovery mail arrives. A dead alias does the opposite: the recovery mail goes to an address that no longer forwards, and the account holder must prove ownership another way, for example with details of a payment method used on the account. The general case is covered in the AliasFleet guide on using an email alias for account recovery.

Steam Guard codes and password resets sent to a paused or deleted alias never arrive. The address on the Steam account must be changed before the alias that holds it is paused or deleted.

Changing the contact email

The contact email on an existing account can be changed from Account Details in the Steam client or on the website, under Contact Info, by selecting "Change my email address". The change requires verification through a code sent to the current inbox or through the mobile authenticator, as described by Recharge. If the old inbox is no longer accessible, Steam offers an option for that case, and Steam Support then asks for proof of ownership, such as past purchase methods, old CD keys, or a linked phone number. The same route moves an existing Steam account from a personal address to an alias, or from one alias to another.

Scale of the platform

Valve's last official figure is 132 million monthly active users, reported in 2021. Analyst estimates for 2025 are higher: GameDiscoverCo estimated roughly 198 million monthly active users in the second half of 2025, extrapolated from Valve's EU Digital Services Act disclosure of 31.1 million monthly active users in the EU, as reported by TheGamer. The 198 million figure is an estimate, not a Valve announcement.

AliasFleet and Steam

AliasFleet provides managed email aliases that forward mail to a permanent destination inbox. A Steam account can use an AliasFleet alias as its contact address, and the alias receives the verification email, the Steam Guard codes and the purchase receipts, which are then forwarded to the destination inbox. The alias is a permanent forwarding address under the user's control, so it keeps receiving mail for as long as the account needs it. AliasFleet does not change Steam's rules: the account remains subject to the Steam Subscriber Agreement, Steam Guard still applies, and trading restrictions after an email change still apply. If the alias is paused or deleted, Steam mail stops arriving, and account recovery then depends on the other proof Steam Support accepts. The forwarding mechanism is described in the AliasFleet guides on what an email alias is and how email aliases actually work, and the guide on using an email alias for Netflix covers the equivalent question for a streaming account. The AliasFleet free tier includes 10 aliases.

Steam accepts an alias address, and the acceptance question is settled at the domain level. The ongoing condition is delivery: the alias must receive Steam Guard codes and recovery mail for the life of the account, and the destination inbox must stay protected. An alias that stops forwarding removes the recovery route with it.

How to Protect Your Email When Signing Up for a DNA Test

Ahsan Luqman — Wed, 11 Nov 2026 00:00:00 +0000

A DNA test signup is protected by one permanent email alias, used for that DNA service only and kept live for as long as the account exists. The alias keeps the real address out of breach files and other services, while results, relative matching, recovery and deletion requests continue to arrive at it. The alias does not hide identity from the DNA company, which still holds the sample, the name and the genetic data. Genetic data cannot be changed after a breach as a password can be changed or a payment card cancelled, so the address attached to it carries more weight than the address on most accounts.

The 23andMe record

In early October 2023, 23andMe disclosed a breach that the company first described as limited and attributed to credential stuffing, and confirmed the full scope that December. About 14,000 accounts were directly compromised through credential stuffing, and attackers used the DNA Relatives feature to reach profile information for about 5.5 million people, plus Family Tree information for about 1.4 million more. The total was 6.9 million affected people, roughly half of the company's then 14 million customers, according to TechCrunch. The exposed data included names, birth years, relationship labels, the share of DNA held with relatives, ancestry reports and self-reported locations.

On 23 March 2025, 23andMe filed for Chapter 11 bankruptcy protection, putting its assets, including the genetic database and the laboratory biobank, up for sale. TTAM Research Institute, a nonprofit founded by co-founder Anne Wojcicki, acquired substantially all of the assets for $305 million and completed the purchase on 14 July 2025, as recorded on Wikipedia. At a House hearing on 10 June 2025, the interim chief executive said about 1.9 million of roughly 15 million customers had asked for their data to be deleted since the filing, as reported by Test Your Genome. That figure is not confirmed from a primary transcript.

On 19 October 2026, California Attorney General Rob Bonta announced a $6 million settlement with Chrome Holding Co., formerly 23andMe, pending court approval. The settlement resolves allegations over the 2023 breach and the state's objection to the sale of Californians' genetic information and samples in bankruptcy without affirmative consent. The breach affected nearly 7 million customers in the United States, including more than 855,000 Californians, according to the California Department of Justice.

The signup address

The address on a DNA test account carries more functions than the address on most accounts: results, relative-matching alerts, password resets and deletion confirmations all arrive there. The California Attorney General's deletion instructions end with a confirmation email that the customer must follow, so a customer who cannot receive mail at the signup address cannot complete the deletion request.

The same address carries account recovery: an alias deleted while the account is live strands it, because mail sent to it bounces and never arrives. The AliasFleet article on using an email alias for account recovery states the rule plainly: a recovery address works only while it stays live and forwards to a controlled inbox. The rule applies to any account, and with more force to a DNA test account, because the data cannot be re-created by signing up again.

Two-factor codes sent to the alias arrive like any other message but expire within minutes, so an authenticator app or a passkey serves as the main second factor, with codes by email as a fallback, as the AliasFleet article on two-factor codes at an email alias explains.

Genetic information and the law

The Genetic Information Nondiscrimination Act of 2008, usually called GINA, is the main federal law governing the use of genetic information in the United States. Title I bars health insurers from using genetic information in underwriting. Title II bars employers with 15 or more employees from using it in employment decisions. The EEOC summary states the rule plainly: an employer may never use genetic information to make an employment decision.

GINA does not apply to life insurance, disability insurance or long-term care insurance. A result showing a known pathogenic variant in BRCA1 or an APOE risk variant could legally factor into a life, disability or long-term care insurance application in most US states, according to the Guide to Genetics.

Law enforcement is a separate matter. 23andMe states that it does not voluntarily share DNA with police and releases data only under valid legal process. Its Transparency Report, last updated 30 April 2026, records 13 data requests received in the United States since 2015, covering 17 user accounts, with data produced for 0 accounts. The company states it will not voluntarily release data to law enforcement, insurance companies or public databases, as shown on the 23andMe Trust Center. Its support pages add that the company does not sell genetic information without explicit consent and shares with law enforcement only under a valid court order, subpoena or search warrant, as set out in 23andMe Support.

MyHeritage states it has never sold or licensed genetic data or health data and will never do so without explicit consent. It will never provide personal data to insurance companies or employers under any circumstances, and it prohibits law enforcement use of its DNA services, according to its privacy policy. FamilyTreeDNA and GEDmatch have allowed law-enforcement matching under opt-in settings. The 2018 identification of the Golden State Killer suspect came after investigators uploaded a crime-scene DNA profile to GEDmatch, where a relative of the suspect had uploaded their own DNA, as set out by GenomeTesting.org.

Privacy policies across services

Nine topics decide what happens to the data: sample storage, deletion exceptions, research consent, partner sharing, law enforcement, de-identification, mergers and bankruptcy, data location and breach notification, according to Test Your Genome.

Research consent should be a separate, optional consent, not a condition of receiving results, as Test Your Genome advises. Withdrawal usually works going forward only. Ancestry states it will not be able to remove de-identified genetic information from active or completed research projects, and 23andMe states research already performed or published before withdrawal will not be reversed or withdrawn.

Deletion has exceptions. Clinical laboratories can have legal retention duties, and Ancestry states it will delete genetic information from its systems within 30 days, with backup copies taking longer to clear.

The merger and bankruptcy clause differs between services. Ancestry's statement says data may be shared with an acquirer and the promises in the privacy statement will continue to apply. 23andMe's current statement goes further for genetic data: it will not sell or transfer genetic data in connection with any merger, acquisition or bankruptcy unless the buyer meets set conditions and agrees to adopt the statement. The sale completed on 14 July 2025 despite the clause, after the court approved the transfer over the state's objection. A buyer that inherits a policy can change it later, and a bankruptcy court can approve a transfer over a state's objection, as the California settlement record shows. An alias does not protect genetic data held by the testing company itself: the 23andMe record shows a breach and a sale happening to the same company within two years.

An email alias does not hide identity from the DNA company. The company still holds the sample, the name, the payment details and the genetic data. The alias limits exposure across services and after breaches. It does not limit what the provider itself knows. A genome remains distinctive even without a name attached: a 2013 study in Science showed surnames could be inferred from some research participants' genomes using public genealogy databases, as reported by Test Your Genome.

The alias setup

One permanent alias per service. The alias is created before signup and used only for that DNA service. One alias per site contains a breach to that site, names the leaker when spam arrives on it, and keeps the real address out of breach files entirely. The AliasFleet article on a different email address for every website sets out the arithmetic: Have I Been Pwned now tracks 1,051 breached sites and more than 17.8 billion exposed addresses, and a reused address stitches accounts together across every future leak.

The alias stays live permanently. A DNA test account differs from a free trial or a newsletter signup. The alias is the account address, and the account needs it for years: results, relative matches, recovery and deletion confirmations. The full address is recorded in a password manager next to the password, so it is at hand when a recovery form asks for it.

Ordinary account protection surrounds the signup. A unique password from a password manager matters here more than usual, because the 23andMe breach began with credential stuffing: attackers fed username and password combinations stolen from other breaches into 23andMe's login page. Checking the old address on Have I Been Pwned before signup shows whether it is already circulating, and the AliasFleet guide to checking whether an email was leaked explains how to read each result.

The alias domain is checked against rejection. Some websites can tell an address is an alias, usually from its domain, and a small number reject alias domains. Detection is not rejection, and plain aliases on clean domains pass more often than random strings on shared domains, as the AliasFleet article on whether websites can tell an alias is in use explains. No DNA service publishes a policy on alias-domain acceptance, and no public test of alias signups at 23andMe, Ancestry or MyHeritage was found, so no claim is made here about any specific service blocking or accepting aliases. If a DNA service rejects an alias domain, an alias on a custom domain or a dedicated real address for that one service is the fallback. No live signup test was run for this piece: that would require creating an account with a real DNA service.

AliasFleet and DNA test signups

AliasFleet is an email alias service that supplies one forwarding address per site, with mail forwarded to a destination inbox and replies sent from the alias. The mechanism is set out in the AliasFleet article on how email aliases actually work: a forwarding rule, a reply mechanism and a kill switch. The free tier covers 10 active aliases. AliasFleet does not hold genetic data, does not run DNA tests, and cannot change a testing company's privacy policy or its law-enforcement record.

Summary of the setup

A DNA test signup uses one permanent alias per service, created before signup and kept live for as long as the account exists, because results, relative matching, recovery and deletion confirmations all depend on it. The account uses a unique password with an authenticator app or passkey as the main second factor. The alias limits exposure across services and after breaches. It does not hide identity from the DNA company or change the service's privacy policy.

Is Posteo Safe? No Personal Data, but Encryption Is Opt-In

Ahsan Luqman — Wed, 11 Nov 2026 00:00:00 +0000

Posteo is a German email service that charges €1 per month for a mailbox built on data minimisation. Signup needs a username, a password and a choice of domain only, with no personal data collected and no IP addresses logged. End-to-end encryption is opt-in, not automatic, and Posteo does not support custom domains. The account includes 4 GB of storage and three aliases, with no free tier and no advertising.

Background and pricing

Posteo e.K. is based in Berlin and was founded in 2009, with servers in data centres in Frankfurt, Germany. The company is financed entirely by its users, with no investors and no advertising, and the feature list states that the price has been stable at €1 per month since 2009. An account can be cancelled at any time, with remaining credit refunded. Posteo reported more than half a million accounts in 2025, a figure given in its transparency report.

The account is a standard mailbox with webmail and support for IMAP, POP3, CalDAV and CardDAV, so it works with external mail clients. The feature list lists 4 GB of storage, expandable to 75 GB at €0.25 per GB per month, three aliases expandable to 25 at €0.10 per alias per month, and three calendars. An S/MIME certificate for signing and encrypting mail costs €3.65 per year. Storage was doubled from 2 GB to 4 GB on 4 February 2026 at no extra cost, according to the Posteo blog.

The account costs €1 per month, paid in advance from a prepaid credit balance, with no contract and a 14-day notice period. The included items are 4 GB of storage, three aliases, three calendars, an address book, notes, spam and virus protection, and free support by email. Extra calendars cost €0.10 per month each. There is no free tier and no free trial.

Signup and data minimisation

Posteo collects no personal data at signup. The feature list states registration without personal data, no IP logging on the website or the email account, IP stripping from outgoing mail, and no connection of payment data to email accounts. An account is created with a username and a password only, with no name, address, phone number or recovery email required. Independent testing by email-tools.me found the same result: the signup form asked for a username, a password and a choice of domain, and nothing else.

Payment is handled separately from the account. Posteo accepts bank transfer, PayPal, credit card and cash sent by post. CyberInsider reports that Posteo manually separates payment information from the account record, and ProPrivacy notes the cash-by-post option and a 14-day money-back guarantee.

Encryption and crypto mail storage

Transport encryption is automatic. The encryption page states that all access to Posteo is encrypted, with TLS 1.2 to 1.3 and Perfect Forward Secrecy, HSTS and DANE/TLSA, and that mail sent to other providers travels over an encrypted connection when the other server supports it. Posteo reports an A+ mark on the Qualys SSL Labs test as of July 2026. All server hard disks are fully encrypted with dm-crypt/LUKS, and internal connections are encrypted with SSH and TLS.

Mail is stored readable on Posteo servers unless crypto mail storage or end-to-end encryption is switched on. A new account has neither feature active by default.

End-to-end encryption is opt-in. The encryption page states that individual emails can be given end-to-end encryption with S/MIME or OpenPGP, that both communication partners need to use the encryption, and that message metadata such as subject, recipient, sender and time stamp remain unencrypted. In February 2026 Posteo released its own S/MIME add-on for webmail, described in the Posteo blog, which had two security audits by independent experts at Cure53 and keeps private keys on the user device. Posteo also offers inbound encryption, which encrypts newly arriving mail with S/MIME or OpenPGP when the sender has not already done so.

Crypto mail storage is a separate optional feature. When it is activated, Posteo encrypts all saved emails, including content, attachments and metadata, using RSA asymmetric encryption, AES with HMAC for symmetric encryption and authentication, and bcrypt hashing, with the key protected by the account password. The encryption page states that the feature passed an external audit by Cure53 and that Posteo cannot deactivate the encryption once it is switched on. Calendar and address book data can be encrypted separately with AES, also protected by the account password. Without crypto mail storage or end-to-end encryption, mail is stored readable on Posteo servers, as it is with most conventional providers.

Transport security and account protection

Posteo holds certification for secure email transport from the BSI, the German Federal Office for Information Security, under technical guideline TR-03108 version 2 (2025), according to Posteo. A comparison by EuropeanStack gives the certificate number as BSI-K-TR-0745-2025, though that number was not found on the Posteo pages read for this article. Posteo implemented DANE/TLSA in May 2014 and states on its encryption page that it was the first provider to do so.

Two-factor authentication is available using TOTP, with a one-time password that changes every 30 seconds, and the feature list also lists app passwords and passkeys, with up to five of each. An additional account protection setting blocks access by external programs using the main Posteo password, so only app passwords work. The encryption page notes that passwords are stored as salted hashes and that Posteo does not know the account password.

The PrivacyPick review states that the audit trail has not been refreshed since 2017, and a full independent audit of the current Posteo codebase was not found in this research. The Cure53 audits cited in this article are feature-specific: crypto mail storage and the S/MIME add-on.

Transparency report and authority requests

Posteo published a transparency report in May 2014, becoming the first German telecommunications provider to do so, and has published one annually since. The transparency report covers all authority requests received up to the end of December 2025. Posteo operates under German law, and the German Telecommunications Act has applied to email services since 1 December 2021, after a period from June 2019 to November 2021 when an EU court ruling had removed that obligation.

Request type in 2025	Count
Requests for user information	72
Mailbox seizures	4
Surveillance orders for a specified period	2
Unclear requests	7
Total requests	85

In 2025 Posteo received 85 requests: 79 from German authorities and 6 from foreign authorities. Posteo lawyers checked the formal correctness of the requests and found 27 of the 72 user information requests formally incorrect. The releases in 2025 were 0 for user information, 0 for traffic data, and content data from 2 mailboxes, both under formally correct judicial rulings. None of the four seizure orders was carried out: three of the mailboxes did not exist and crypto mail storage was activated for one of them. With no personal data or traffic data held, mailbox content is the only data that can be handed over under a court order, and only from mailboxes that exist and are not protected by crypto mail storage.

No public breach of Posteo itself was found in the research for this article. That is absence of a public record, not proof that no breach has happened. An address can be checked on Have I Been Pwned. The companion trust pieces on GMX Mail, AOL Mail and mail.com cover large free providers whose safety turns on the security stack rather than on data minimisation.

Custom domain availability

Posteo does not support custom domains. The PrivacyPick review states that the only choice is between Posteo domains, and EuropeanStack describes the refusal as deliberate, to avoid the identity records that domain ownership would require. That reason comes from independent reviews rather than from a Posteo page read for this article. A business or a person who needs an address on a domain they own cannot use Posteo for it, and the address cannot be moved to another provider if Posteo is left. Posteo also has no free tier, and no recovery route that works without the account password when crypto mail storage is active, since Posteo cannot read the encrypted data to restore it.

AliasFleet and Posteo

AliasFleet creates managed, persistent email aliases that forward to a mailbox, so the mailbox address is not shared with websites or services. A Posteo mailbox works as the destination for those aliases, and the Posteo address stays private while each website or service gets its own alias. If one alias starts receiving spam or appears in a breach, that alias can be paused or closed without touching the Posteo account or any other alias. The same pattern is described in the companion trust pieces on Gmail and Outlook, and in the guide to whether email aliases are safe.

Posteo already offers three aliases inside one account, but those are tied to the Posteo account and to Posteo domains, while AliasFleet aliases sit in front of the mailbox and can be managed independently of it. The AliasFleet documentation explains how aliases forward and how replies are routed, and pricing is on the AliasFleet pricing page.

Posteo holds no personal data, no IP addresses and no payment data connected to the account. Mail in an unprotected mailbox can be obtained under a court order, and Posteo does not support custom domains.