Spam to e-mail address of MetaBrainz (and FB)

[NeroA]

Today I received spam to my e-mail address I’m using on MetaBrainz.

It’s a “Hello Dear” message from “jessica” (atakokossi82@gmail.com). In the body jessica_nasa@yahoo.com is used.

The e-mail address I’m using on MetaBrainz is from ProtonMail (only by web mail, strong password) and I’m just using it on MetaBrainz, but I’ve used it also on Facebook (end 2017, account closed mid 2018, rarely used, no apps).
I never published my e-mail address.
I never get spam (to this address) till now.

So I see just two possible leaks (beside my computer and the mailbox provider): MB and FB.

Are there known leaks on MB? Does someone have problems with spam, related to MB?

[chaban]

I too got a spam mail to my address used for MB (and only few other sites, 5 plus a 6th one after the spam mail) but only once.
Received it on 2019-09-20T22:00:00Z. It was advertising CBD.
(and was my first spam mail ever :D)

BTW, you can’t trust the From field. Spammers like to spoof it.

@NeroA

Are there known leaks on MB?

Well, there was a leak a few years ago. But emails were not included.

[NeroA]

@chaban

BTW, you can’t trust the From field. Spammers like to spoof it .

Yes, I know.
I just named it to help to identify it, for the case other people get the same spam, or someone wants to block it, or …

BTW: I also get almost no spam, expect on services where you can bet to get spam (but I use several account, many aliases, Spamgourmet and other trash mail services, and I don’t publish my addresses anywhere).

[elomatreb]

Note that spammers will also just brute-force email addresses, esp. for popular providers like protonmail they often have lists of possible usernames and just try them all. If you run your own email server, you see spam to addresses that have never been used.

[chaban]

Guess this is the reason:

PSA: we might have accidentally leaked your email address and birth date

Hi! Sorry to say, but if you add annotations, we’ve likely accidentally leaked your email address and birth data in JSON code shown in some pages’ source. So if you have found yourself receiving spammy emails to an account you only use in MusicBrainz, that’s probably why. We have hotfixed the bug now (and be reassured this didn’t affect any actual passwords, so you don’t need to rush to change them anywhere), but it’s still pretty embarrassing, so sorry again! You can read more about the issue…