A breach that traces back to an ESP API key, a court ruling that upends what "proof of consent" even means, and a regulator that spent five months silently failing its own deliverability test. Heavy week. Let's get into it.
Extortion group FulcrumSec is claiming theft of roughly 8.7 million customer profiles from Manchester Airports Group — email, name, phone, postcode, IP address — and 8.6 GB of data. The attack vector wasn't a password spray or a phished credential. It was an Iterable API key, left sitting in public-facing client-side JavaScript, that let the group pull records directly from the ESP integration.
No hacking required. Not in the traditional sense, anyway — nobody cracked a login, nobody exploited a server vulnerability. They just found a secret that was never supposed to be visible and used it exactly as designed.
This is the third or fourth version of this story I've seen this year, and the pattern is hardening: ESP API keys are production secrets, full stop. They belong in a secrets manager and behind a backend proxy, not in a <script> tag your marketing team can see in DevTools. If your integration ships a write-capable API key to the browser, you don't have a marketing stack — you have an exposed database with a friendlier UI.
Sources: BleepingComputer, EmailExpert
Sponsor this newsletter
Reach 206 people who build and run email.
This spot is open. One sponsor per issue, no competing ads — your logo, your words, and a link, right here in the middle of the read.
See rates and availability →The Düsseldorf Administrative Court ruled in July that an email address, an IP address, and a timestamp — the standard double opt-in log that nearly every ESP generates by default — do not, on their own, prove valid consent under GDPR. The court's reasoning: an IP address identifies a device, not the person who clicked the link. It also faulted the sender for failing to retain the actual content of the confirmation email itself.
That's the headline change. The metadata trail most compliance teams have leaned on for a decade just got demoted from "proof" to "supporting evidence."
If you send into the EU, the practical fallout is concrete: you likely need to archive the full confirmation email — not just the log line that says it was sent — to survive a future consent challenge. Check your retention setup before a regulator or a plaintiff's lawyer checks it for you.
Source: EmailExpert
Here's the number that should get your attention: five months. Between March 1 and August 3, 2026, email from Australia's corporate regulator ASIC — including business-name renewal notices sent from @asic.gov.au — failed to reach Gmail recipients. Nobody at ASIC noticed until August 27. The agency hasn't disclosed the technical cause or how many messages or recipients were affected.
Not blocked with a bounce. Not flagged with a complaint spike. Just quietly buried, provider by provider, for the better part of half a year.
This is the deliverability nightmare scenario practitioners already know in their bones: a domain-specific, provider-specific failure that generates zero signal because the mail never got far enough to trigger one. If your monitoring strategy is "wait for someone to complain," this is what happens instead — silence, for months, from the exact recipients who most needed the notice.
Source: EmailExpert
On August 26, the US Treasury added Italian digital-services collective Autistici/Inventati to its Specially Designated Nationals list, citing its encrypted email tools under counterterrorism authority. Two days later, autistici.org went into serverHold at the registry — Public Interest Registry, the US-based operator of the .org namespace. Users could still read old mail. They couldn't send or receive new mail.
The mechanism here is the part worth sitting with: this isn't a takedown of infrastructure the collective controls. It's a US sanctions action reaching into DNS/registry infrastructure — operated by a US entity regardless of where the provider's servers or users actually are — to disrupt service.
If you run an email service and think jurisdiction is something you can architect your way around, this is a live counterexample. Your registrar's home country can override your own.
Source: EmailExpert
Microsoft detailed a phishing campaign that embedded invisible Unicode tag characters inside financial keywords — "funding," specifically — so the word rendered normally to a human reader but broke keyword-based and some ML-based filter matching underneath. The technique originated in AI prompt-injection research and got repurposed for financial fraud, tied to an SBA-themed scheme.
The headline number: signature hits spiked from roughly 21,000 to more than 1.3 million messages in a single day at the campaign's February 2026 peak, with days as high as 2.37 million.
The nuance worth knowing: Microsoft says 99%+ of it still got caught, just not by keyword matching — reputation signals, authentication checks, and ML models further down the stack picked up the slack. That's a genuinely useful data point next time someone argues layered defense is overkill. One layer failed completely here. The stack held anyway.
Source: Security Boulevard
That's the week. If something is wrong, reply and tell me — I read every response.
— John
This Week In Email — thisweekin.email
Subscribe to This Week in Email and get future issues delivered to your inbox.