2026: Cross-Border Sellers Find Their Company Email Leaked—Check Address Exposure or Account Takeover First?

A company address appears in a breach notice, and unfamiliar sales emails start arriving.

Fastest route: treat address exposure and mailbox takeover as separate questions. Check sign-ins, recovery settings, forwarding, inbox rules, and unexpected sending through your provider’s official site before deciding what to change.

This guide is for cross-border sellers who found a company address on a public page, in a breach notice, or on an unfamiliar marketing list.
It also helps small-business owners dealing with unusual sign-in alerts, unexplained mail rules, or messages sent without their approval.
If you manage a team, use the steps to assign checks without disrupting customer and order communications.

Read the evidence before labeling the incident

A leaked or publicly listed address can attract unsolicited messages. That does not establish that someone signed in to the mailbox. An address is a contact detail; the mailbox is an account with its own access records, recovery options, connected apps, and mail settings.

Keep these findings separate:

• Address exposure: The address appears in a notice, public listing, or message sent to a broad audience. This may increase unwanted contact, but it is not proof of account access.
• Suspicious contact: Sales pitches, password-reset messages, or unexpected login warnings may merit attention. They do not, by themselves, establish which system exposed the address or whether a sign-in succeeded.
• Possible account compromise: Unfamiliar successful sign-ins, recovery details you did not add, forwarding destinations you do not recognize, or messages you did not send are stronger reasons to follow account-recovery steps.

Save the breach notice, the message headers where available, the time you received alerts, and a short record of what you observed. Do not infer that a particular platform or supplier exposed your address unless its notice or an investigation supports that conclusion.

The FTC’s business data-breach response guide recommends a deliberate response: investigate what happened, secure affected systems, and consider who needs to be notified. The exact response depends on what data and systems were involved, and any notification duties depend on the facts and applicable jurisdiction.

There is a clear business reason not to dismiss mailbox compromise as a nuisance. The FBI’s IC3 BEC guidance reports more than $55.5 billion in exposed dollar losses worldwide between October 2013 and December 2023 from business email compromise. That figure describes reported BEC losses over that stated period; it does not show that your address or business has been affected.

Check mailbox control from a trusted route

Do not sign in through a link in a suspicious message. Open the email provider’s app or type its known web address yourself. If you use a managed business account, involve the administrator through your established internal process.

Review the account in a consistent order:

• Recent activity: Look for successful sign-ins, devices, locations, and sessions you cannot explain. The Google account activity page describes the information shown in Gmail’s recent activity. Google says this view includes the last 10 IP addresses that accessed the account, with associated locations and times. Treat a location as a clue to investigate, not as conclusive proof by itself.
• Recovery options: Check whether the recovery email address or phone number is still yours or controlled by your organization. An unexpected change can make it harder to regain access.
• Connected access: Review applications and services that have permission to access the mailbox. Remove access you cannot account for, following the provider’s instructions and your organization’s approval process.
• Forwarding and filters: Check for unfamiliar forwarding destinations, filters, or inbox rules that could hide or copy messages. Google’s instructions for forwarding and filters explain where to review those settings in Gmail. Other providers may use different names and menus.
• Outgoing messages: Look for sent mail, drafts, or replies you did not create. Also check whether customers or partners report receiving unexpected messages that appear to come from your address.

Record what you find before changing settings, when it is safe to do so. A brief log helps you explain the incident to your provider or administrator and reduces the chance that teammates repeat checks or overlook a setting.

If you find a successful sign-in you cannot explain, an altered recovery method, a suspicious rule, or mail sent without your approval, use the provider’s official compromised-account recovery process. For Microsoft accounts, follow Microsoft’s recovery guidance for a hacked or compromised account. For a work-managed mailbox, contact the administrator as well. Do not assume that deleting a suspicious message or changing one password resolves every connected access path.

Make the decision from account evidence

Use the following branches to choose the next action. If the evidence fits more than one branch, act on the higher-risk one.

• If you only have a public listing, breach notification, or increase in unsolicited mail, and provider records show no unexplained account changes: treat this as address exposure for now. Save the evidence, check that recovery information remains under your control, and continue monitoring through official account tools. Do not tell customers that the mailbox was taken over unless you have evidence for that claim.
• If you see unfamiliar successful access, an unknown forwarding destination, unexpected filters, changed recovery details, or mail you did not send: treat the mailbox as potentially compromised. Follow the provider’s recovery process, involve your administrator if applicable, and assess business accounts that depend on that mailbox.
• If the provider cannot confirm what happened, the account is locked, or evidence conflicts: contact the provider or organization administrator through a trusted channel. Preserve the notice and relevant records. Avoid announcing a confirmed breach until the facts support that description.

These branches answer different questions. Address exposure can call for tighter contact handling and future registration hygiene. Confirmed unauthorized access calls for account recovery and a review of business systems. A temporary address for future signups cannot undo an exposure that has already happened, prove that your mailbox is secure, or replace recovery work.

FAQs for sellers and small teams

A breach notice lists my work address, but the mailbox looks normal

A listing alone does not establish mailbox access. Confirm what the notice says was exposed, when it happened, and whether it identifies your address. Then check your provider’s activity and security settings directly. If you find no unexplained access or changes, record the result and monitor the account; do not treat a notice about an address as confirmation of a mailbox takeover.

I see a forwarding destination or sign-in I do not recognize

Save the relevant details, then follow the provider’s official instructions for securing or recovering the account. Check related settings as well as the sign-in record: an unfamiliar forwarding destination or filter can affect what you see in the inbox. If your mailbox is administered by your company, involve the administrator. Use a trusted route to contact support, not a link in an unexpected email.

Unsolicited pitches have increased, but there are no account alerts

A rise in unwanted mail can indicate that your address is being circulated, but it cannot establish the source or prove account access. Keep representative examples and review account activity and mail settings. If those checks show no unauthorized changes, handle the issue as an exposure and inbox-management problem. Escalate only if account evidence or a reliable incident notice changes the assessment.

What should I secure first if I find unauthorized mailbox activity?

Protect accounts that could disrupt trading, redirect funds, or lock you out: store administration, payment and payout services, customer communications, and recovery channels. Check each service through its official entry point and review its own activity and recovery settings. Keep essential business messages on an address you control for the long term; do not move them to a short-lived inbox.

Protect business continuity before notifying people

Once you have evidence of unauthorized access, identify what the mailbox could reach and what it could send. Start with the business functions that would be hardest to recover or most disruptive to customers:

• Store and marketplace administration: Check access, recovery details, and relevant activity through each platform’s official account area.
• Payments and payouts: Review account access and recent changes. Treat unexpected requests to change payment details as a separate matter requiring verification through established channels.
• Customer conversations: Decide whether any customer messages, order details, or support threads may have been exposed or altered.
• Recovery channels: Check which accounts rely on the affected mailbox to reset passwords or receive security alerts. Update recovery arrangements only through each service’s official process.
• Team access: Find out who can access the mailbox and whether a shared password, delegated access, or connected app needs to be reviewed.

Prioritize by business impact, not by which notification arrived first. An account that controls store access or recovery deserves attention before a low-risk software trial. Keep a written record of who checked each service, what they found, and what remains unresolved.

Coordinate customer and team communication

Anomalous mail does not automatically mean that you should send a warning to every customer. First establish what happened and whether messages or data were affected. If there is a credible risk to customers, employees, or partners, use a communication channel you trust and tailor the message to the known facts. Avoid repeating unverified claims or sending sensitive details through the mailbox under investigation.

For a small team, assign clear owners:

• One person handles contact with the email provider or IT administrator.
• One person checks store, payment, and account-recovery settings.
• One person maintains the incident record and tracks open questions.
• A designated owner decides whether customers, employees, partners, or authorities need to be contacted.

These can be separate duties even when one person performs more than one. The key is to record responsibility and decisions, rather than assume someone else has already handled them. Legal and contractual notification obligations depend on the incident and the jurisdictions involved; verify them with qualified advice or the relevant authority instead of relying on a generic checklist. The FTC’s business response guide is a useful reference for organizing a response, not a substitute for determining your specific obligations.

Keep essential mail separate from low-risk registrations

After the incident review, reduce future exposure without weakening account recovery or customer service. Your company’s primary business address should remain available for customers, orders, payments, platform administration, and important account recovery. Those uses need continuity and accountable ownership.

Separate those responsibilities from low-risk registrations, such as evaluating a tool that does not handle essential business data and does not need long-term recovery. Before choosing an address for a signup, check the service’s rules, whether it may require later access, and whether your team must retain the messages. An address that you cannot reliably access later is not a safe choice for an account you need to keep.

A simple routing model can help:

• Customer, order, payment, and platform-management mail: Keep it on a durable business address that the right people can access and recover.
• Ongoing vendor relationships and operational tools: Use an address with an owner, documented access, and a clear handover plan.
• Short evaluation or low-risk registrations: Consider an alias, forwarding arrangement, or temporary inbox only when the service permits it and you do not need that address for long-term recovery.

If you are deciding between a separate inbox and an alias, the inbox-or-alias guide can help you weigh continuity and separation. For SaaS evaluations, use the signup privacy checklist to consider what information a registration requests before providing a business address.

For a small team, keep a lightweight register of tool accounts: service, business purpose, address used, internal owner, recovery contact, and whether the tool is still active. Review the register during handovers and when an evaluation ends. This will not stop every unwanted message, but it helps you identify who owns an account and prevents a departing employee’s address from becoming the only recovery path.

Use temporary inboxes only after the security review

A separate address can reduce how often you give your main business inbox to low-risk services. It cannot remove an address already exposed in a breach, confirm that an account is safe, or replace the mailbox recovery and business-account checks above.

When the mailbox checks are complete, and a signup is permitted, does not support essential operations, and does not require future recovery, you can consider a temporary inbox for that registration. Check the service’s current features and retention behavior before relying on it. Do not use a short-lived address for customer messages, orders, payments, platform administration, or recovery of important business accounts.

For cross-border sellers, the useful division is operational: keep a long-term, controlled address for the business, and use separation only where losing access would not interrupt trading. If that fits your next low-risk evaluation, review the current options on MyTempBox before signing up. That keeps the decision tied to the actual registration and the address behavior you can verify, rather than treating a new inbox as a fix for an incident that has already occurred.

Frequently asked questions

Does a company email in a breach notice mean someone accessed the mailbox?

No. A notice that an address appeared in exposed data establishes a possible address exposure, not mailbox access. Check the notice’s scope and date, then use your email provider’s official account activity and security settings to look for unfamiliar access or changes. Treat confirmed unauthorized activity differently from an address appearing in a list.

Where can I check for unfamiliar sign-ins or forwarding?

Open your email provider’s website or app directly, not a link in an alert. Review recent account activity, recovery methods, connected applications, forwarding destinations, filters, and inbox rules. Look for changes you cannot explain and save relevant details. If you find an unknown sign-in or setting, follow the provider’s official recovery instructions.

Can a surge in sales pitches prove that my company address was leaked?

No. More unsolicited messages can follow address exposure, but they do not show where an address came from or prove that anyone entered the mailbox. Record the messages and check whether they contain a reliable link to a specific incident. Make the account-security decision from provider records and settings, not from message volume alone.

Which business accounts should I secure if the mailbox may be compromised?

Start with accounts that can interrupt trading or enable money movement: store administration, payment and payout services, customer communications, and account-recovery channels. Check each service through its official site, update recovery details where appropriate, and review recent activity. Keep essential customer, order, payment, and recovery mail on an address your business can control long term.