According to research by Cybernews, French email provider Alinto has accidentally exposed over 40 million SMTP records in a major data leak. The exposed data includes email metadata linked to major companies such as L’Oréal, Renault, and DHL, as well as thousands of French government email addresses.
Despite email being one of the oldest technologies on the internet, it’s still critical to how businesses and governments operate today.
In this case, researchers discovered a publicly accessible database containing around 40 million SMTP (Simple Mail Transfer Protocol) records. While the contents of emails weren’t exposed, the metadata behind them was — and that’s where the real risk lies.
The leak was traced back to an unsecured Elasticsearch cluster, likely linked to Alinto’s Cleanmail email security service. Once disclosed, the database was taken down quickly — but not before the data had already been exposed.
The leaked records included:
Even though there was no email content, around 4.5 million records contained unique email addresses — a mix of personal and corporate accounts.
Big-name organisations impacted include:
On top of that, at least 14,000 French government email addresses were exposed, including embassies, municipalities, and other official bodies worldwide.
At first glance, you might think “no email content = no problem.” Not quite.
Metadata is incredibly valuable to attackers.
With access to who is emailing whom, when, and how often, cybercriminals can:
In short, this is prime material for social engineering.
If an attacker knows you regularly email a supplier every Monday morning, it’s not hard to spoof that interaction and slip something malicious into your inbox.
This breach is a solid reminder that:
If your business relies on external email or cloud providers, it’s worth asking some tough questions about how your data is being stored and secured.
We hope you’ve liked this blog. Stay tuned for more blogs like this. Stay safe!
