A researcher bought noreply.net. Companies started sending him secrets.

An investigation by cybersecurity researchers has revealed a widespread data exposure risk stemming from companies misconfiguring automated email systems.

After purchasing domain names like "noreply.net" and "deleteduser.com" with the intention of using them for personal routing or catch-all testing, researchers Cory Solovewicz and Mike Sheward discovered they were receiving hundreds of thousands of automated messages meant to be unmonitored. These inadvertent emails contained highly sensitive material, including internal company credentials, medical and injury reports, booking confirmations, and employee vacation approvals. Instead of safely discarding outbound communication or properly deleting old profiles, organizations had merely rewritten target email addresses to these common placeholder domains, unaware that they could be actively owned and monitored.\n\nTo mitigate the risk of these inadvertent streams falling into malicious hands, the researchers have collectively registered dozens of other logical placeholder domains. During his presentation at the Defcon security conference, Solovewicz highlighted that his scanned findings indicate this issue is merely the tip of a much larger data security iceberg. While some businesses have quietly remedied their configurations after being contacted, many have failed to respond, showcasing the difficulties of managing large-scale notifications. Security experts emphasize that organizations must thoroughly audit their internal messaging configurations and switch to standardized, non-existent designations like the ".invalid" top-level domain to prevent leaking private consumer and corporate data.