A Sneaky Phish Just Grabbed my Mailchimp Mailing List

Troy Hunt · 25 Mar 2025

Troy Hunt did not write this page.

Every claim below was made in this piece, quoted word for word and numbered in the order the piece makes them, so you can read it there rather than take our word for it. The sentence above each quote is our reading of the claim, not their wording. Each quote was checked against a stored copy of the page at build time; where the two differ, the quote is the fact.

Our reading
A modern phish is automated end to end: the stolen credentials are used and the data exported within moments of being entered.

Their wordsThis was obviously highly automated and designed to immediately export the list before the victim could take preventative measures.
Our reading
A breached organisation owes its customers a fast and transparent disclosure, and that obligation applies to the person saying it too.

Their wordsWhen I have conversations with breached companies, my messaging is crystal clear: be transparent and expeditious in your reporting of the incident and prioritise communicating with your customers.

Keep reading

The other pieces are the ones whose claims are worded most like this one's. That measures language, not agreement: they may argue the opposite.