A small business owner I know built her site's contact form with an AI website builder in an afternoon, wired it up to email every submission straight to her personal inbox, and never thought about it again. The form itself worked exactly as intended for months. The problem turned out to be sitting somewhere else entirely.
What actually went wrong
That personal email account had been part of an unrelated data breach at a completely different service, months earlier, the kind of breach that shows up in the news for a week and then everyone forgets about it. Her password had been part of that leak, and she hadn't gotten around to changing it, since the breach notification hadn't felt urgent enough to act on immediately. Someone eventually used that leaked password to access the inbox directly.
Why this became a bigger problem than a compromised personal email usually is
A compromised personal inbox is already a real problem on its own. This one was worse because it had been quietly receiving every single contact form submission for months: names, emails, phone numbers, and in a few cases, fairly detailed messages describing what a customer needed help with. None of that data lived in any database she controlled or thought of as part of her business's actual systems. It had been accumulating, unnoticed, in a personal inbox with a password from a years-old, unrelated breach, completely outside any of the checks she might have run on her actual website.
Why this is such an easy blind spot
Wiring a contact form to email straight to a personal inbox feels like the simplest, most direct way to get notified, and it usually is fine, functionally. It also quietly turns that personal inbox into an unofficial customer data store, one that almost certainly isn't protected with the same care, two-factor authentication, a strong unique password, regular review, as an actual business system would be, because it never registered as a business system in anyone's mind.
What actually changed after this
- The personal inbox got a strong, unique password and two-factor authentication turned on immediately, treating it as the sensitive business asset it had quietly become.
- Contact form submissions started going to a dedicated business email address instead, one covered by the same security practices as other business tools, rather than a personal account.
- She now checks any personal account that receives business-related information, however minor it seems, against breach-notification services, and treats a notification as something to act on immediately rather than something to notice and set aside.
- Old submissions sitting in that inbox got reviewed and, where no longer needed, deleted, rather than accumulating indefinitely as an unofficial, unmanaged customer record.
This one had nothing to do with her actual website's code, which was fine the whole time. It's a reminder that customer data doesn't only live in your database. It lives anywhere you've told it to go, including a personal inbox that's easy to forget was ever handling business information at all.