Picture a Tuesday morning. You open your email and there are 900 new messages. Welcome to a gardening newsletter. Confirm your subscription to a shoe store. Thanks for registering with a software company you have never heard of. More arrive every few seconds.
It looks like a glitch or a prank. It is not. It is called a subscription bomb, and it is usually cover for something worse.
How the attack works
An attacker takes your email address and signs it up for hundreds or thousands of real websites, all at once, using automated tools. Every one of those websites does exactly what it should and sends you a legitimate confirmation email. Within minutes, your inbox is buried.
The flood is a distraction. While you are deleting newsletters, the attacker is using stolen details to sign in to your bank, buy something on your account, or change a password. The bank sends a fraud alert. The store sends a receipt. The service sends a password reset. All of it lands in the middle of the pile, and by the time you dig it out, the money is gone.
Why spam filters do not stop it
Every message in a subscription bomb is real. It comes from a legitimate business, passes every authentication check, and looks exactly like the mail you sign up for every day. A filter that judges one email at a time has nothing to object to. The danger is not in any single message. It is in the pattern.
What OpenEFA does now
OpenEFA now recognises the pattern of a subscription bomb as it starts. When it sees one, it holds the flood of signup and confirmation mail aside in quarantine. Everything else keeps arriving normally.
Three things we got right on purpose:
- It is on for everyone. Every mailbox on our hosted MailGuard service has Subscription Bomb Protection as of today, with nothing to configure. Deployments on your own premises receive it with their next update.
- We hold the flood, we do not destroy it. Held messages sit in quarantine. If one of them turns out to be something you wanted, it is one click to release it.
- Normal busy days are left alone. A big reply-all thread or a rush of event registrations is not an attack. Before turning this on, we checked it against months of real mail to make sure ordinary busy days do not trip it.
And if the attacker gets into the account itself
The flood exists to hide something. For customers who also use EFAidentity, our account takeover detection and response service, a subscription bomb is now matched against what is happening to the same person's account. A flood plus a new sign-in, a password reset or a changed MFA method becomes one critical account-takeover alert that pages an engineer, and the account's sessions are revoked automatically. More in When the Inbox and the Sign-in Compare Notes.
What to do if you are ever bombed
If your inbox suddenly floods with signup emails, treat it as a warning sign, not an annoyance:
- Check your bank and credit card accounts for charges you did not make.
- Look for password reset or “new sign-in” emails you did not ask for.
- Change the password on your email account and turn on multi-factor sign-in if you have not.
- Contact your IT provider. If that is us, we can see the flood on our side and help you sort through it.
Already an OpenEFA or MailGuard customer?
You are already protected. No action needed. Not yet a customer? Talk to us about OpenEFA.