I'm apparently on this list: DONOTUSEPOD1NON@list.att.com<p>Here are some screenshots of the debacle [edit: properly redacted now]<p><a href="https://imgur.com/a/MWV2wmk" rel="nofollow noreferrer">https://imgur.com/a/MWV2wmk</a><p><a href="https://imgur.com/a/yRJCKUn" rel="nofollow noreferrer">https://imgur.com/a/yRJCKUn</a><p>It started out when someone wrote to that mailing list with<p>>
This is a test to see if external users can email AT&T's internal email list with the most recent email mishap.<p>followed by other responses like<p>> I guess so…<p>> So far, based on the number of unique domains coming back directly to me (and replying all), it appears to be mostly business customers. I am assuming business because I also used my gmail for my business when I set up an AT&T account. Time will tell of course but there's definitely not an insignificant number of people on this list as far as I can tell.<p>> We’re just lucky there aren’t multiple people with vacation responses on eh?
Legit, I'm the OP of the first email. AMA.<p>No, they didn't leak the email list, but they did leak their internal email list and showed that the incompetently set up an exchange DL and allowed anyone to email it instead of a restricted set of users. They also didn't take the time to close it down, they instead deleted it.<p>If I wasn't the OP, I wouldn't know that John Hammond is making a video of this right now. Check back in a few hours when this comment ages like fine wine.
I'm surprised this hasn't happened before, @list.att.com is just a standard listserv type system, internally anyone can create and manage lists of email addresses with internal or external addresses in it and those lists are all open to the public internet if you know their address.<p>I can't remember if there is any kind of access control that the owner of the list can implement to prevent external messages to the list address but no longer have access to check.