How they got your address

By MercPrivacy · Published 2026-07-06 · Updated 2026-08-05

Breach corpora, scrapers, pre-checked boxes, list brokers and data-broker profiles — the five routes your email travels into spam lists, and the habits that close each one going forward.

Your email address was not guessed. Somewhere between the day you created it and this morning's junk, it was collected, packaged and sold — probably several times, by several parties, none of whom asked you twice. Spam is a supply chain, and your address is the raw material.

Understanding the acquisition routes matters for a practical reason: each one has a different fix. The defense against a breached database is not the defense against a pre-checked marketing box, and neither is the defense against a scraper. People who treat all spam as one undifferentiated plague end up fighting none of the sources well.

Here are the routes, roughly in order of how much mail they explain.

## The five ways addresses get harvested

- **Data breaches and their afterlife** — when a company you had an account with gets breached, your address, often alongside passwords and profile details, enters criminal circulation. Breach corpora get merged, deduplicated and resold for years; an address exposed once follows you indefinitely. This is the route that pairs your email with enough context to make scams feel personal. - **Scraping** — automated harvesting of addresses posted in public: business websites, directories, forum posts, PDFs, social profiles. If your address is printed anywhere a crawler can read, assume it has been collected. - **Co-registration and the buried checkbox** — the sign-up page said "partners may contact me with offers," and the box came pre-checked. You technically opted in to a network of companies you have never heard of. This is how a single newsletter signup becomes dozens. - **List brokers and rented lists** — a legal gray market where addresses are packaged by demographic and interest, then rented or sold to whoever pays. The sellers change; the list persists and mutates. - **The data-broker profile** — people-search and data-broker sites compile identity dossiers where your email sits next to your phone number, address history and household details. [What a broker profile holds](https://mercprivacy.com/knowledge/what-a-data-broker-knows) surprises most people, and that same dossier works as a lookup service for anyone who wants a fuller picture behind an address they already have.

> Your inbox is not unlucky. It is on a list, and the list is for sale.

## Why the flood tracks your profile

Notice that the routes feed each other. A breach supplies the address; a broker profile enriches it; a co-registration network confirms a human reads it; a scraper ties it to your job. The result is that spam volume is not random — it tracks how widely your identity circulates. This is the same circulation that drives [why the calls started](https://mercprivacy.com/knowledge/why-the-calls-started); email is simply the cheapest channel running on the same pipeline.

That is also why the fix is structural rather than message-by-message. Deleting spam does nothing upstream. Shrinking your circulating footprint does. Data-broker and people-search listings are removable by opt-out, though they repopulate as brokers re-acquire data, which is why removal has to recur rather than happen once. Several states now back this with enforceable deletion rights, and California went further: its Delete Act created a one-stop deletion platform that consumers have been able to file through since January 2026, with registered brokers required to begin processing those requests as of August 2026. Recurring removal is the core of [our privacy service](https://mercprivacy.com/privacy).

## Hygiene going forward

You cannot un-ring the bells already rung, but you can stop casting new ones. The habits that pay:

1. **Alias by vendor.** Many mail providers support plus-addressing — yourname+store@ and so on — and dedicated alias services go further. Give every signup its own address and you will know exactly who leaked or sold it when spam arrives on that alias, and you can kill the alias without touching your real inbox. 2. **Segment by importance.** One address for banking and government, one for commerce, one burner for anything experimental. A breach in the junk tier never touches the tier your bank writes to. 3. **Uncheck the box, read the sentence.** The co-registration sentence sits one line above the submit button. Ten seconds of reading is the cheapest opt-out you will ever perform. 4. **Get your address off the public web.** Replace printed addresses on your site with a contact form; if an address must stay published for business reasons, expect harvest and segment accordingly. 5. **Use the mainstream suppression tools for the lawful tier.** The marketing industry's own preference service at [dmachoice.org](https://dmachoice.org) trims mail from mainstream marketers, and [optoutprescreen.com](https://optoutprescreen.com) shuts off prescreened credit offers at the source. Neither touches criminals, but they quiet the lawful layer so the unlawful layer becomes visible.

## Reading your own spam as a map

Once aliases are in place, your junk folder turns diagnostic. Spam to the alias you gave one retailer tells you that retailer's list leaked or was sold. Spam to an address only ever printed on your website tells you scrapers found it. Spam to your oldest personal address quoting an ancient password tells you which breach era it came from. Each points at a different upstream problem and a different remediation — and when the mail itself lies about its sender, it crosses from nuisance into the territory [state falsity laws care about](https://mercprivacy.com/knowledge/state-spam-laws-that-still-pay).

## If you want the pipeline shut down

Mapping where your identity circulates and running the recurring removals is the unglamorous center of what we do. [Stephanie](https://mercprivacy.com/stephanie) can tell you instantly and free what your exposure likely looks like, and [how it works](https://mercprivacy.com/how-it-works) explains the cleanup. We are not a law firm; when a matter requires legal representation, a licensed attorney is engaged.