Very few were deliberately sold; almost all leaked through negligence, ignorance, or simply getting hacked. Hacked sites seem to be the most common source, and

Very few were deliberately sold; almost all leaked through negligence, ignorance, or simply getting hacked. Hacked sites seem to be the most common source, and I often find out a service I use has been hacked before any public announcements. Sales and support teams are the second most common. They use enrichment tools and CRMs that pull data from sources like ClearBit—but they also submit data. This is pervasive in B2B industries. I’ve confronted sales teams about this in the past, and it’s contributed to our company leaving one service for a competitor who isn’t leaking our employee data. Ever since I noticed this happening, I’ve started using fake names in any forms that are likely to end up in a CRM. Even if they try to guess my primary email from my name—which many of these enrichment services do—I’ll know which sales teams I want to avoid. It occasionally leads to some awkward conversations when I have to explain that I’m not actually the named person and that person doesn’t actually exist, but anyone in sales is going to understand—and, if they’re smart, watch their step.