Why Your Business Inbox Is Also an Identity System

A total of 37 breach events were found and analysed resulting in 23,246,438 exposed accounts containing a total of 48 different data types of personal datum. The breaches found publicly and freely available included Colombian Combo, McKesson, ULP 0050, SMTP Combo List and China Admissions. Sign in to view the full library of breach events which includes, where available, reference articles relating to each breach.

Email sits at the centre of business identity

An email address is commonly used to identify a person across cloud applications, supplier portals, professional platforms and customer services. The mailbox behind it may also receive password-reset links, multi-factor authentication messages and notifications about account changes.

For many employees, control of email can influence access to several other services. A corporate mailbox can also represent authority. Messages sent from the account may be trusted by colleagues, customers and suppliers because they carry a familiar name and company domain. This gives email several overlapping roles:
- A communications channel
- A sign-in identifier
- An account-recovery route
- A repository of business history
- A mechanism for approving or initiating work
- A representation of the organisation’s identity

Businesses should therefore protect email as identity infrastructure rather than treating it as an ordinary productivity application.

The BreachAware team has recorded and reviewed the provenance of this material. The descriptions shared here are intentionally limited, providing defenders with useful context without publishing source locations, detailed contents or information that could encourage misuse.

What the collection labels tell defenders

ULP 0050 is structured around URL, login and password fields. Colombian Combo is a regionally labelled credential collection, while SMTP Combo List is organised around mail-related authentication data.

These labels classify the material; they do not establish a single source, collection date or compromise method for every record. A regional label should not be interpreted as proof that every person currently lives in that location, holds that nationality or used a service based there. Compiled material can cross borders and may include historical, duplicated or republished records.

Similarly, the SMTP label does not mean that every record represents an active business mailbox. Some credentials may be outdated, invalid or associated with services that are no longer used. The defensive value comes from checking verified matches against current identities and systems—not assuming that every entry remains usable.

Why healthcare and admissions provide useful context

McKesson works with healthcare providers, pharmacies, manufacturers, biopharma organisations and governments to deliver healthcare products and services. China Admissions supports international students applying to Chinese universities. [McKesson describes its healthcare relationships](https://www.mckesson.com/about-mckesson/key-facts/), while [China Admissions explains its university-application service](https://www.china-admissions.com/about-china-admissions/).

These descriptions do not establish which data types were present in either event. In particular, McKesson’s inclusion should not be used to infer that patient, prescription or clinical information was involved.

The sector context is still useful because healthcare and admissions both generate communications that recipients may consider urgent or consequential. A message about a medicine, application deadline, supporting document or account problem may receive attention more quickly than an ordinary marketing email.

That does not mean exposed information will be used in this way. It means businesses should make sensitive workflows safe even when a message contains accurate and familiar context.

A mailbox can create downstream exposure

If an email password is exposed, the immediate concern is access to the mailbox. The potential impact does not necessarily end there.

The same password may have been reused on another service. The mailbox may receive account-recovery messages. Existing correspondence may reveal customers, colleagues and suppliers. Rules or connected applications may continue processing messages after the password has changed. This is why email incident response should consider more than credential rotation.

Depending on the evidence, a review may need to include:
- Active sessions and recognised devices
- Mail-forwarding and inbox rules
- Connected applications
- Delegated mailbox access
- Recovery email addresses and telephone numbers
- Application-specific passwords
- Recent account or security-setting changes
- Other services recovered through the mailbox

These checks should be proportionate to the account’s role and the provenance of the exposure. They are not evidence that any of these mechanisms were altered in the events found this week.

Email authentication has two different meanings

Businesses need to protect both the person accessing the mailbox and the organisation sending messages from its domain. User authentication answers: “Is this person allowed to access the account?” Domain authentication helps receiving systems assess: “Was this message authorised by the organisation it claims to represent?”

Multi-factor authentication, session controls and secure recovery processes protect the user account. Standards such as SPF, DKIM and DMARC help protect the organisation’s sending identity and reduce opportunities for unauthorised domain impersonation.

One does not replace the other. A correctly configured domain cannot prevent compromise of a genuine mailbox. Strong user authentication cannot prevent every attempt to imitate the company through an unauthorised mail system. A mature email-security programme accounts for both risks.

What the weekly totals do and do not show

The 23,246,438 exposed accounts should not be interpreted as the same number of unique or newly affected people. Credential collections may contain:
- Historical passwords
- Duplicate or repackaged records
- Inactive mailboxes
- Several accounts belonging to one person
- Credentials already changed by the account holder
- Records associated with discontinued services

The 48 data types were identified across all 37 events. This does not mean that every record contained every type, or that each event involved similarly diverse information.

The named examples are also not evidence that healthcare, education or Colombian organisations were disproportionately affected. They are selected examples from the wider material found and analysed during the week.

Volume establishes the scale of the data processed. Current validity, organisational role and account privilege determine the response priority.

Three defensive checks for B2B organisations

1. Protect the mailbox as a high-consequence identity
Require multi-factor authentication for business email, starting with administrators, executives, finance teams and employees who can access sensitive data.

Use phishing-resistant authentication where practical. CISA recommends requiring MFA across services such as email, file storage and remote access, with stronger methods used where available. [Read CISA’s business MFA guidance](https://www.cisa.gov/audiences/small-and-medium-businesses/secure-your-business/require-multifactor-authentication).

Review older authentication methods and application passwords. Disable routes that are not needed and ensure recovery mechanisms receive protection appropriate to the mailbox.

2. Monitor what happens after authentication
Successful login should not be the end of the security decision. Look for unusual forwarding rules, unfamiliar application connections, unexpected session locations and changes to recovery information. Monitoring should also identify abnormal outbound activity without treating normal sales, support or marketing volumes as inherently suspicious.

Higher-consequence changes should generate alerts that reach somebody other than the potentially affected mailbox.

3. Make important requests independently verifiable
A message from a genuine business address can still be unauthorised if the account has been compromised. Payment instructions, bank-detail changes, sensitive document requests and new access approvals should be verified through an established second channel. Staff should use trusted contact information already held by the organisation rather than details supplied within the message.

This protects the business process even when the email looks technically and contextually authentic.

The wider lesson

This week’s credential collections show why email cannot be secured solely as a messaging product.

A mailbox may unlock other accounts, preserve years of business context and communicate with the authority of the organisation’s domain. Its security therefore affects identity, data protection and business decision-making simultaneously.

This does not mean every credential in a combo list is current or that every exposed mailbox has been accessed. It means verified matches deserve assessment based on what the account can recover, approve and communicate.

The most useful question is not simply, “Can somebody read this person’s email?” It is, “Which other identities, relationships and decisions depend on control of that mailbox?”