[ale] OT(ish) Sold or stolen?

[Alex Carver]

I have cell service with AT&T and, in their section of the account for
handling billing information, there's a spot to add an email address for
billing notifications.  I have long ago opted out of all marketing
options offered and for many years didn't get much except notices the
bill is due.

Two years ago I decided to give them a new email address which was a
randomly generated alias at my domain and hosted on my own server.  I
had done that with several other companies (bank, credit card, etc.),
just hadn't gotten around to AT&T yet.

Two years and all was fine.  A few days ago, I suddenly start receiving
tons of spam attempts (usually blocked by an RBL) and connection
attempts on my server.  I always have the exim logs showing on my
screen, I can see emails coming in as it happens including the failures.
 This was the first time that any of my random aliases were used by
someone other than the company that has it.  Until this point no one
tried these addresses because they weren't advertised anywhere by any
mechanism.

I never gave anyone else that particular alias, I don't use it as a
username for my online account access, it's not stored in my phone or on
any address books, and I don't send email from it (receive only alias).

I've already called their fraud department who proceeded to spend 40
minutes on the phone with me using various levels of technical jargon
plus pointing fingers to shift the blame away from them (at one point
they actually said "A third party must have your email address.")

Do you think it was sold and they got caught with their hand in the
cookie jar or stolen and they don't know there's a breach in progress?

Aside from the fraud group which has advised me that they are opening an
investigation (maybe) would you suggest I talk to anyone else?


Exim's logs show attempts coming in from a vast array of countries
including Italy, Canada, Switzerland, Brazil, Romania, Argentina,
Bulgaria, Portugal, Serbia, Germany, Austria, Israel, India, Turkey,
Spain, Croatia, Venezuela, Columbia, Poland, Iraq (by way of Al
Jazeera's servers of all things) and quite a few servers within the US
plus many, many more that I didn't spend time looking up just yet.