Loading story…
A new report from Proton Mail reveals that 80% of major US retailers embed tracking pixels in their marketing emails, enabling them to monitor recipients' clicks, device types, locations, and the times emails are opened. Over a 28-day period, 50 leading retailers sent 42 billion marketing emails, with the volume nearly doubling during Black Friday and Cyber Monday. These tracking technologies allow retailers to build detailed profiles on consumers, raising significant privacy concerns as described by Proton Mail, which characterizes the practice as an engineered assault on privacy.
The widespread use of email for both marketing and business communication increases the risk of exposing personally identifiable information (PII). PII, which includes names, email addresses, and financial details, is frequently transmitted and stored in email systems that were not originally designed with robust security controls. This makes email a prime target for attackers seeking to harvest sensitive data through phishing, spoofed domains, or compromised mailboxes, potentially resulting in compliance penalties, financial losses, and erosion of trust for organizations whose data is exposed.
See the reporting duties and controls this puts on the clock.
4 events from the most recent confirmed update back to the earliest known activity.
On 2025-12-15, a Security Boulevard article and podcast discussion highlighted Proton's findings during the 2025 holiday shopping season, warning that tracking pixels in promotional emails enable behavioral profiling and broader privacy-invasive data collection.
On 2025-12-10, reporting on Proton Mail's 'Spam Watch: The US Inbox Overload + Hidden Tracker Report' publicized the findings, including the retailers with the highest email volume and tracker usage and the existence of several brands that used no trackers during the study period.
By the end of the study period on 2025-12-01, Proton found that 80% of the sampled retailers used tracking pixels and/or tracking links in marketing emails, with 40 of 50 brands having at least one tracker in every email observed. The report also estimated retailers send about 1.3 billion marketing emails per day in a normal week, rising to roughly 2.55 billion per day during the Black Friday to Cyber Monday period.
From 2025-11-04 to 2025-12-01, Proton Mail analyzed marketing emails from 50 major US retailers, collecting metadata and identifying embedded tracking pixels and links in promotional messages.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
3 references tracked. Mallory keeps watching after this page renders.
securityboulevard.com
Open sourcesecurityboulevard.com
Open sourcezdnet.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A Barracuda report revealed that 78% of organizations experienced an email breach in the past year, with phishing, impersonation, and account takeover attacks leading to significant business disruption, data loss, and reputational harm. The report highlights that smaller firms bear a higher per-employee cost for breach recovery, and slow detection of email-based threats is closely linked to increased ransomware risk, with 71% of breached organizations also suffering ransomware attacks. The average cost of recovery varies by company size, but the consequences—ranging from lost business to prolonged reputational damage—are widespread across industries. In a notable example, Volvo Group North America was affected by a data breach originating from its third-party HR software provider, Miljödata. Sensitive employee data, including Social Security numbers, was exfiltrated, and the incident exposed delays in detection and notification, raising concerns about forensic readiness and incident response maturity. Volvo responded by offering identity protection services to affected employees, but the breach underscores the critical need for rapid, integrated forensic response and robust communication protocols, especially when third-party vendors are involved.
Jul 12, 2026
Security researchers who registered abandoned or commonly misused domains such as **`noreply.net`**, **`noreply.us`**, and **`deleteduser.com`** began receiving large volumes of misdirected automated email from companies, exposing a widespread data leakage problem. Reports say one domain alone received **401,796 messages** since December 2024—about 700 per day—with mail arriving from thousands of sender addresses and root domains. The messages were generated by corporate systems rather than individual users, showing that many organizations continue to route notifications and workflows to recycled, invalid, or poorly controlled addresses. The unintended emails reportedly included sensitive business and personal information, attachments, HR requests, hotel bookings, Zoom invitations, and other internal communications. Researchers said the issue stems from weak email hygiene, poor account deprovisioning, and unsafe use of placeholder or supposedly non-monitored addresses in automated systems. The findings highlight an avoidable exposure risk that can be reduced through stricter auditing of outbound email flows and the use of internal-only or guaranteed-invalid domains for non-deliverable addresses.
Aug 12, 2026
Target, Neiman Marcus, and Home Depot disclosed major payment-card breaches in which attackers planted **point-of-sale malware** on in-store checkout systems and harvested customer data at scale. Target said about **40 million** payment cards were exposed during the 2013 holiday shopping period, with later estimates rising to as many as **110 million** people affected when personal information was included. Reporting tied the Target intrusion to customized memory-scraping malware related to **BlackPOS**, which was used to collect card data from checkout terminals and stage it on internal servers before exfiltration; investigators and the U.S. Secret Service were drawn into the case as the breach became one of the largest retail compromises on record. Neiman Marcus also reported that its breach was worse than first disclosed, adding to the wave of retail intrusions. Home Depot later revealed a similarly large compromise affecting its U.S. and Canadian self-checkout systems, saying attackers stole more than **56 million** payment card numbers and over **53 million** email addresses after entering through credentials taken from a third-party vendor and moving laterally through the network. The incidents intensified pressure on U.S. retailers and payment providers to move away from vulnerable magnetic-stripe cards toward **EMV chip** technology, while also imposing steep business costs: Target reported a sharp profit decline, tens of millions of dollars in breach-related expenses, and warned that litigation, fraud losses, and investigative costs could continue to materially affect results. Together, the breaches showed how weak vendor access controls, hard-to-detect POS malware, and outdated payment technology enabled large-scale theft of card data from major retailers.
Jun 29, 2026