# Email address leak **URL:** \ **Category:** The Johnny.Decimal system\ **Created:** [March 4, 2026, 6:40am UTC](https://forum.johnnydecimal.com/t/email-address-leak/2886 "2026-03-04T06:40:31Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![johnnydecimal](https://forum.johnnydecimal.com/user_avatar/forum.johnnydecimal.com/johnnydecimal/32/1759_2.png) [@johnnydecimal](https://forum.johnnydecimal.com/u/johnnydecimal)\ **Post date:** [March 4, 2026, 6:40am UTC](https://forum.johnnydecimal.com/t/email-address-leak/2886/1 "2026-03-04T06:40:31Z")
Hey all. This happened yesterday, should have posted these here, sorry. Following up today with a full report which I’ll post here. > **[22.00.0185 A security incident](https://johnnydecimal.com/20-29-communication/22-blog/22.00.0185-security-incident/)** > > Email addresses have leaked from somewhere. > **[22.00.0186 I uploaded your email address to GitHub](https://johnnydecimal.com/20-29-communication/22-blog/22.00.0186-i-uploaded-your-email-address-to-github/)** > > I really did. ---
**Author:** ![johnnydecimal](https://forum.johnnydecimal.com/user_avatar/forum.johnnydecimal.com/johnnydecimal/32/1759_2.png) [@johnnydecimal](https://forum.johnnydecimal.com/u/johnnydecimal)\ **Post date:** [March 4, 2026, 6:10pm UTC](https://forum.johnnydecimal.com/t/email-address-leak/2886/2 "2026-03-04T18:10:25Z")
> **[22.00.0187 Post-incident review](https://johnnydecimal.com/20-29-communication/22-blog/22.00.0187-post-incident-review/)** > > Here's what happened, how it happened, what I did about it, and what I'm doing to make sure it can't happen again. ---
**Author:** ![brookscl](https://forum.johnnydecimal.com/user_avatar/forum.johnnydecimal.com/brookscl/32/918_2.png) [@brookscl](https://forum.johnnydecimal.com/u/brookscl)\ **Post date:** [March 4, 2026, 6:50pm UTC](https://forum.johnnydecimal.com/t/email-address-leak/2886/3 "2026-03-04T18:50:37Z")
This sucks and I’m sure you feel awful about it. I haven’t viewed my email address as a private resource for a long time, and for your newsletter I use a Feedbin masked email address anyway. Thanks for the full disclosure. I think no less of JD. ---
**Author:** ![bdillahu](https://forum.johnnydecimal.com/letter_avatar_proxy/v4/letter/b/71e660/32.png) [@bdillahu](https://forum.johnnydecimal.com/u/bdillahu)\ **Post date:** [March 4, 2026, 7:33pm UTC](https://forum.johnnydecimal.com/t/email-address-leak/2886/4 "2026-03-04T19:33:31Z")
Agreed… ---
**Author:** ![St\_David](https://forum.johnnydecimal.com/user_avatar/forum.johnnydecimal.com/st_david/32/1416_2.png) [@St\_David](https://forum.johnnydecimal.com/u/St_David)\ **Post date:** [March 4, 2026, 7:45pm UTC](https://forum.johnnydecimal.com/t/email-address-leak/2886/5 "2026-03-04T19:45:58Z")
+1! I too think no less of JD! ---
**Author:** ![ozhoom](https://forum.johnnydecimal.com/user_avatar/forum.johnnydecimal.com/ozhoom/32/1955_2.png) [@ozhoom](https://forum.johnnydecimal.com/u/ozhoom)\ **Post date:** [March 4, 2026, 8:25pm UTC](https://forum.johnnydecimal.com/t/email-address-leak/2886/6 "2026-03-04T20:25:08Z")
As they say, E Coli happens. I wish other companies would be as open and as quick as JD. I use alias email addresses. No hard feelings at all. ---
**Author:** ![johnnydecimal](https://forum.johnnydecimal.com/user_avatar/forum.johnnydecimal.com/johnnydecimal/32/1759_2.png) [@johnnydecimal](https://forum.johnnydecimal.com/u/johnnydecimal)\ **Post date:** [March 4, 2026, 8:28pm UTC](https://forum.johnnydecimal.com/t/email-address-leak/2886/7 "2026-03-04T20:28:07Z")
Thanks, everyone. The response to my email has been amazing and heartwarming. ---
**Author:** ![Teknon31](https://forum.johnnydecimal.com/letter_avatar_proxy/v4/letter/t/77aa72/32.png) [@Teknon31](https://forum.johnnydecimal.com/u/Teknon31)\ **Post date:** [March 4, 2026, 9:38pm UTC](https://forum.johnnydecimal.com/t/email-address-leak/2886/8 "2026-03-04T21:38:32Z")
I echo the above sentiments and am impressed at the integrity which you’ve shown in the way that you’ve handled this. I long ago started using unique Duck addresses for each thing that I sign up for, so no data of value in my case. Please don’t be too discouraged over this incident. ---
**Author:** ![DavidK](https://forum.johnnydecimal.com/user_avatar/forum.johnnydecimal.com/davidk/32/1913_2.png) [@DavidK](https://forum.johnnydecimal.com/u/DavidK)\ **Post date:** [March 4, 2026, 10:00pm UTC](https://forum.johnnydecimal.com/t/email-address-leak/2886/9 "2026-03-04T22:00:05Z")
Thanks for letting us know. My email address got leaked when Experian got hacked a few years ago. I do now use Duck addresses when I remember. Thanks for being so honest. ---
**Author:** ![Patterner](https://forum.johnnydecimal.com/user_avatar/forum.johnnydecimal.com/patterner/32/1936_2.png) [@Patterner](https://forum.johnnydecimal.com/u/Patterner)\ **Post date:** [March 4, 2026, 10:16pm UTC](https://forum.johnnydecimal.com/t/email-address-leak/2886/10 "2026-03-04T22:16:20Z")
Thanks for the report and notification." ”fortunately” this address is already in every database. but it’s gmail and i don’t use it for anything “important”. so anything banking related i’m getting is obviously spam. and for banks and stuff i use individiual addresses like icbc+46283@myowndomain.ext ---
**Author:** ![cjeane01](https://forum.johnnydecimal.com/letter_avatar_proxy/v4/letter/c/3be4f8/32.png) [@cjeane01](https://forum.johnnydecimal.com/u/cjeane01)\ **Post date:** [March 4, 2026, 10:22pm UTC](https://forum.johnnydecimal.com/t/email-address-leak/2886/11 "2026-03-04T22:22:33Z")
Thanks for being so quick to notify us. No harm, no foul, I don’t use my personal email for anything other than personal friends. ---
**Author:** ![shefi1280](https://forum.johnnydecimal.com/letter_avatar_proxy/v4/letter/s/ecae2f/32.png) [@shefi1280](https://forum.johnnydecimal.com/u/shefi1280)\ **Post date:** [March 5, 2026, 1:00am UTC](https://forum.johnnydecimal.com/t/email-address-leak/2886/12 "2026-03-05T01:00:57Z")
Which email address? I use different ones for JDHQ and for this forum. I assumed you meant the JDHQ email so I changed my primary email for JDHQ. ---
**Author:** ![Jeff-LovettSundries](https://forum.johnnydecimal.com/user_avatar/forum.johnnydecimal.com/jeff-lovettsundries/32/1198_2.png) [@Jeff-LovettSundries](https://forum.johnnydecimal.com/u/Jeff-LovettSundries)\ **Post date:** [March 5, 2026, 1:16am UTC](https://forum.johnnydecimal.com/t/email-address-leak/2886/13 "2026-03-05T01:16:54Z")
No worries. Thanks for the heads up. ---
**Author:** ![ToddZ](https://forum.johnnydecimal.com/letter_avatar_proxy/v4/letter/t/45deac/32.png) [@ToddZ](https://forum.johnnydecimal.com/u/ToddZ)\ **Post date:** [March 5, 2026, 4:06am UTC](https://forum.johnnydecimal.com/t/email-address-leak/2886/14 "2026-03-05T04:06:40Z")
No worries, JD! The way you handled it should be a template for others to follow. I reserve all my ire for the bottom-feeders scraping GitHub and the corporations who sell my info for profit. ---
**Author:** ![johnnydecimal](https://forum.johnnydecimal.com/user_avatar/forum.johnnydecimal.com/johnnydecimal/32/1759_2.png) [@johnnydecimal](https://forum.johnnydecimal.com/u/johnnydecimal)\ **Post date:** [March 5, 2026, 5:24am UTC](https://forum.johnnydecimal.com/t/email-address-leak/2886/15 "2026-03-05T05:24:38Z")
> [@Patterner](#): > > and for banks and stuff i use individiual addresses like icbc+46283@myowndomain.ext We’re going to start doing this. I have done, in the past, but found it too much of a PITA when I later wanted to email _out_ from that address. For a support issue or whatever. Seems the 1Password + Fastmail integration should solve that, so we’re going to have a look at that. And if we’re going to help ‘normal people’ do this, it has to be the path of least resistance. ---
**Author:** ![Patterner](https://forum.johnnydecimal.com/user_avatar/forum.johnnydecimal.com/patterner/32/1936_2.png) [@Patterner](https://forum.johnnydecimal.com/u/Patterner)\ **Post date:** [March 5, 2026, 5:55am UTC](https://forum.johnnydecimal.com/t/email-address-leak/2886/16 "2026-03-05T05:55:55Z")
fortunately i have only a couple of important accounts like that. one bank, one ISP, 2 email accounts, etc. anthing that could be painful and/or expensive when lost. ---
**Author:** ![jan0sch](https://forum.johnnydecimal.com/letter_avatar_proxy/v4/letter/j/f04885/32.png) [@jan0sch](https://forum.johnnydecimal.com/u/jan0sch)\ **Post date:** [March 5, 2026, 8:17pm UTC](https://forum.johnnydecimal.com/t/email-address-leak/2886/17 "2026-03-05T20:17:57Z")
A bit ironic that I switched from a throw away address to a “real one” for JD last year. But sh… happens. 😅 Thank you for being open about it and the good post mortem writeup. ❤ ---
**Author:** ![MrBullshead](https://forum.johnnydecimal.com/letter_avatar_proxy/v4/letter/m/958977/32.png) [@MrBullshead](https://forum.johnnydecimal.com/u/MrBullshead)\ **Post date:** [March 5, 2026, 9:02pm UTC](https://forum.johnnydecimal.com/t/email-address-leak/2886/18 "2026-03-05T21:02:33Z")
@johnnydecimal It takes courage and integrity to be this transparent and open about your own mistakes. Thank you. ---
**Author:** ![claudinec](https://forum.johnnydecimal.com/user_avatar/forum.johnnydecimal.com/claudinec/32/1216_2.png) [@claudinec](https://forum.johnnydecimal.com/u/claudinec)\ **Post date:** [March 7, 2026, 12:01pm UTC](https://forum.johnnydecimal.com/t/email-address-leak/2886/19 "2026-03-07T12:01:01Z")
I just replied to your email (I am as usual very late in responding) but wanted to add since you mentioned Fastmail: if you’re using your own domain with Fastmail, it’s very easy to use arbitrary [plus addresses](https://www.fastmail.help/hc/en-us/articles/360060591053-Plus-addressing-and-subdomain-addressing#plus) without needing to set them up beforehand, no other integrations needed. But if you’re also using 1Password, that integration _does_ give you an alternative way to add aliases on the fly and save them in 1Password at the same time. ---
**Author:** ![trintera](https://forum.johnnydecimal.com/user_avatar/forum.johnnydecimal.com/trintera/32/999_2.png) [@trintera](https://forum.johnnydecimal.com/u/trintera)\ **Post date:** [March 8, 2026, 7:38pm UTC](https://forum.johnnydecimal.com/t/email-address-leak/2886/20 "2026-03-08T19:38:16Z")
> [@johnnydecimal](#): > > Seems the 1Password + Fastmail integration should solve that Fastmail DOES allow you to send from any email in your domain using the catch-all persona. Unfortunately many other services, including [mailbox.org](http://mailbox.org) and Proton Mail only allow a fixed number of aliases to be able to send from. This might lock you in, in the future. Another way to achieve something similar is the [addy.io](http://addy.io) service. You can create a username (for free) and create unlimited addresses from there. For example I could use [jdhq@myusername.anonaddy.com](mailto:jdhq@myusername.anonaddy.com) for JDHQ or [amazon@myusername.anonaddy.com](mailto:amazon@myusername.anonaddy.com) for my Amazon account. You can reply to any received email through their service. [Next page](https://forum.johnnydecimal.com/t/email-address-leak/2886.md?page=2)