You Don’t Need to Hack a Company. Sometimes They’ll Email You Their Secrets.

What if you could receive a company’s private information without hacking its network, bypassing a firewall, or stealing a password? You might only need to buy the right domain name. That’s what security researcher Cory Solovewicz discovered after purchasing noreply.net. Instead of becoming the quiet corner of the internet he expected, the domain started receiving a staggering number of emails from companies and organizations that apparently assumed nobody was listening. Some contained ordinary automated notifications. Others contained far more sensitive information, including test credentials, employee data, customer orders, injury reports, and thousands of attachments. And this wasn’t a single company making a mistake. Solovewicz found thousands of domains that could potentially receive email this way, raising a much bigger question about how companies handle data after an account, employee, or system is supposed to disappear. The strange part is that none of this required breaking in. The companies were sending the information themselves. The “Noreply” Address Wasn’t Going Nowhere When Cory Solovewicz bought noreply.net, he wasn’t trying to uncover a massive security problem. He had originally purchased similar domains for a personal email project. The idea was to simply use a catch-all inbox to receive messages sent to any address on the domain. Then the emails started arriving. And they kept arriving. Since buying noreply.net in 2024, Solovewicz says the domain has received more than 400,000 messages, including more than 28,000 attachments. Across noreply.net and noreply.us, the messages came from more than 14,000 sending addresses belonging to roughly 6,200 root domains. The figures and findings above were reported by WIRED based on Solovewicz's research. The volume was surprising. What those messages contained was more concerning. Some organizations were sending information that was never supposed to reach an unrelated third party because they believed the destination address effectively didn't exist. It did. Someone simply owned it. Why “Noreply” Can Become a Real Inbox The problem starts with an assumption built into many automated systems: That an address containing words like noreply or deleteduser is effectively a dead end. But email doesn’t work that way. If a company sends a message to someone@noreply.net, that message still needs a real domain and a real mail server to receive it. If someone else owns that domain and has configured it to accept incoming mail, the message has a destination and that destination may be controlled by a complete stranger. This can happen when companies repurpose placeholder addresses, fail to properly remove old accounts, or continue sending automated notifications to domains they no longer control. The result is a strange kind of security failure: the attacker doesn't have to break into the system because the system is already delivering the data to them. And the information being sent isn't necessarily harmless. That is where this becomes much bigger than a few misplaced emails. The Emails Were Far From Harmless Solovewicz says he received everything including test platform credentials, service orders, injury reports and even customer information. Some messages contained attachments that can easily turn an abandoned email address into a potential repository of sensitive data. Another researcher, Mike Sheward, found the same problem after purchasing domains such as deleteduser.com. His inbox received hotel bookings containing people’s names, work vacation requests, Zoom meeting invitations, and other information that organizations apparently believed would disappear into a dead account. In one particularly striking example, an AI company reportedly sent thousands of CCTV images to one of Sheward’s domains. The images were intended for a system that monitors workers at industrial sites in the Middle East. That changes the nature of the problem. This isn't about companies sending an occasional email to the wrong person. Automated systems can keep doing it at scale, potentially exposing customer data, employee information, credentials, and internal material without anyone actively trying to steal it. And once the data reaches a domain controlled by someone else, the company has already lost control of it. The Problem Isn’t Email The researchers’ findings point to a surprisingly simple security lesson: A system can be perfectly secure from an attacker and still leak data because it sends that data somewhere it shouldn’t. Solovewicz scanned 7,136 domains and found 328 configured with catch-all inboxes. That doesn’t mean all of them were leaking sensitive information, but it shows how easily forgotten email infrastructure can become a security problem. The fix is not particularly exotic. Companies can use internal domains for placeholder addresses or reserve domains such as .invalid that are guaranteed not to exist. The harder part is changing the assumption behind these systems. A noreply address isn't a black hole. A deleteduser account isn't necessarily gone. And a domain nobody expects to monitor can still have a real owner. Companies spend enormous amounts of money protecting their networks from increasingly sophisticated attacks. But sometimes the easiest way to get their secrets isn't to break through the door. It's to wait for the company to send them to you.