--- id: CP-564 slug: bulk-email-bcc-hidden-recipients lang: en title: Sending bulk email with Bcc description: "Writing to several external recipients without exposing their addresses: the Bcc reflex, common pitfalls and what to do after a mistake." canonical_url: https://startbrain.io/cyberpedia/en/articles/bulk-email-bcc-hidden-recipients/ markdown_url: https://startbrain.io/cyberpedia/en/articles/bulk-email-bcc-hidden-recipients.md publisher: Brain (https://startbrain.io) license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) cite_as: Brain, "Sending bulk email with Bcc", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/bulk-email-bcc-hidden-recipients/ (CC BY 4.0) wing: 5 theme: outsmart_social_engineering reflex: cr-041 schema: G5 updated: "2026-11-03" translations: en: https://startbrain.io/cyberpedia/en/articles/bulk-email-bcc-hidden-recipients/ fr: https://startbrain.io/cyberpedia/fr/articles/courriel-groupe-copie-cachee-cci/ de: https://startbrain.io/cyberpedia/de/articles/sammelmail-bcc-verdeckte-empfaenger/ es: https://startbrain.io/cyberpedia/es/articles/correo-grupal-copia-oculta-cco/ sources: - "n": 1 title: "Violations de données personnelles : les règles à suivre" publisher: CNIL url: https://www.cnil.fr/fr/violations-de-donnees-personnelles-les-regles-suivre published: "2018-06-19" accessed: "2026-11-03" - "n": 2 title: Phishing for Information, Technique T1598 - Enterprise | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1598/ accessed: "2026-11-03" - "n": 3 title: "Phishing scams: how to spot and report them" publisher: NCSC (UK) url: https://www.ncsc.gov.uk/collection/phishing-scams published: "2021-11-26" accessed: "2026-11-03" - "n": 4 title: Que faire en cas de phishing ou hameçonnage ? publisher: Cybermalveillance.gouv.fr url: https://www.cybermalveillance.gouv.fr/tous-nos-contenus/fiches-reflexes/hameconnage-phishing published: "2020-01-10" accessed: "2026-11-03" - "n": 5 title: Notifier une violation de données personnelles publisher: CNIL url: https://www.cnil.fr/fr/services-en-ligne/notifier-une-violation-de-donnees-personnelles published: "2018-05-24" accessed: "2026-11-03" - "n": 6 title: CHAPITRE IV - Responsable du traitement et sous-traitant publisher: CNIL url: https://www.cnil.fr/fr/reglement-europeen-protection-donnees/chapitre4#Article33 accessed: "2026-11-03" --- # Sending bulk email with Bcc Before sending an email to thirty customers, partners or training participants, the rule is to check which field each recipient is placed in. Once the message has gone, the addresses have already reached the recipients. This page describes the step to take before sending: placing external recipients in the Bcc (blind carbon copy) field. It also describes the usual pitfalls, what exposed addresses allow a scammer to do, and the steps to follow after a mistake. The sources cited here do not describe how the To, Cc and Bcc fields work: this page therefore gives the conduct to follow, without going into the mechanics of the email software. ## In 30 seconds - Where it happens: when sending a message to several people outside the company (customers, candidates, participants, partners). - What the attacker wants: to use the information available about you to make phishing messages more convincing [3]. - The reflex: put external recipients in Bcc, then check the To, Cc and Bcc fields before clicking Send. - If it has already happened: warn the data protection officer (DPO) or, failing that, the IT department without delay, who will assess whether the CNIL must be notified [1][5]. ## Straight answers ### Why is a visible list of addresses a problem? The GDPR defines a data breach as a breach of security leading, accidentally or unlawfully, to, among other things, the « divulgation non autorisée de données à caractère personnel » (unauthorised disclosure of personal data) [1]. The CNIL specifies that this covers any security incident, malicious or not, intentional or not [1]. A message in which all recipients appear in view of the others can therefore fall under this definition, even without any attack. The CNIL cites a similar case: a third party informs the data controller that it has received an email containing information about another person, and provides proof of it. The controller must then be considered informed of the breach [1]. ### What are the harvested addresses used for? The sources cited here describe how attackers use information of this kind. The UK NCSC writes that criminals use information available online to make their phishing messages more convincing [3]. MITRE describes "phishing for information": messages sent to obtain information that can then be used to target a victim [2]. According to MITRE, the Kimsuky group used targeted phishing emails to gather information about its victims, including contact lists, in order to identify other targets [2]. Phishing consists of posing as a trusted third party in order to obtain personal or banking data [4]. ### Who is responsible for the mistake? The GDPR obligations fall on the data controller, that is, the organisation, whether public or private and whatever its size [1]. For an employee, the useful point lies elsewhere: as soon as they notice the mistake, they report it internally, because it is the organisation that decides what happens next. ## How it works The GDPR text requires the data controller to notify a breach to the supervisory authority without undue delay and, where feasible, no later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of individuals [6]. The CNIL adds that this period starts when the controller has a reasonable degree of certainty that an incident has occurred and affected personal data [1]. The level of risk determines the obligations [1]. With no risk, the organisation documents the incident internally in a register. With a risk, it documents it and notifies the CNIL. With a high risk, it documents it, notifies the CNIL and also informs the people concerned. Risk is assessed case by case, according to the nature and sensitivity of the data, how easily the people can be identified and their possible consequences [1]. A lone address and an address that reveals membership of a sensitive group are not judged the same way, but this assessment falls to the organisation, not to the sender. ## What you do Before sending a message to several external people: - Place external recipients in the Bcc field, not in To or Cc. - Check all three fields before sending: no external address should remain in To or Cc. - If the message is sent often (newsletter, meeting notice), ask the IT team for a sending tool designed for this purpose rather than repeating the manual steps by hand. After a mistake: - Warn the DPO or the IT department immediately, with the subject of the message, the time it was sent and the number of recipients. - Do not try to settle the matter alone by writing to the recipients: the organisation must first assess the risk. - Keep the sent message. For phishing, Cybermalveillance.gouv.fr recommends keeping the evidence [4]. The same reflex serves here as the basis for documenting the incident. On the organisation's side, the CNIL asks for the incident to be documented: nature of the breach, categories and approximate number of people concerned, likely consequences, measures taken or planned [5]. If there is doubt about the need to inform the people, the CNIL advises notifying it of the incident, and it will say whether they must be informed [5]. Notification is made through an online service dedicated to organisations [5]. If all the information is not available within the 72-hour period, an initial notification can be followed by a supplementary one [5]. ## Pitfalls - Forgetting Bcc: putting a single recipient in To, typing the others in Cc out of habit, or pasting the whole list into the wrong field. Checking the fields before sending is the safeguard. - Forwarding or replying to all: before forwarding a message or replying to all, check which addresses appear in the fields. - Believing the incident has no consequences: the addresses are already with third parties, and the NCSC points out that scammers use available information to make their messages more credible [3]. The recipients may therefore receive suspicious messages afterwards: the organisation can advise them not to reply to dubious messages and to report them to Signal Spam [4]. The sources cited here report no dated case of a bulk email sent with visible addresses: this page therefore presents none. ## Sources 1. CNIL, "Violations de données personnelles : les règles à suivre", 19 June 2018. https://www.cnil.fr/fr/violations-de-donnees-personnelles-les-regles-suivre (accessed 3 November 2026) 2. MITRE ATT&CK, "Phishing for Information, Technique T1598 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1598/ (accessed 3 November 2026) 3. NCSC (UK), "Phishing scams: how to spot and report them", 26 November 2021. https://www.ncsc.gov.uk/collection/phishing-scams (accessed 3 November 2026) 4. Cybermalveillance.gouv.fr, "Que faire en cas de phishing ou hameçonnage ?", 10 January 2020. https://www.cybermalveillance.gouv.fr/tous-nos-contenus/fiches-reflexes/hameconnage-phishing (accessed 3 November 2026) 5. CNIL, "Notifier une violation de données personnelles", 24 May 2018. https://www.cnil.fr/fr/services-en-ligne/notifier-une-violation-de-donnees-personnelles (accessed 3 November 2026) 6. CNIL, "CHAPITRE IV - Responsable du traitement et sous-traitant". https://www.cnil.fr/fr/reglement-europeen-protection-donnees/chapitre4#Article33 (accessed 3 November 2026) --- Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/bulk-email-bcc-hidden-recipients/ You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.