Sending bulk email with Bcc
Writing to several external recipients without exposing their addresses: the Bcc reflex, common pitfalls and what to do after a mistake.
In 30 seconds
- Where it happens
- When sending a message to several people outside the company (customers, candidates, participants, partners).
- What the attacker wants
- To use the information available about you to make phishing messages more convincing3.
- The reflex
- Put external recipients in Bcc, then check the To, Cc and Bcc fields before clicking Send.
What it is
Before sending an email to thirty customers, partners or training participants, the rule is to check which field each recipient is placed in. Once the message has gone, the addresses have already reached the recipients.
This page describes the step to take before sending: placing external recipients in the Bcc (blind carbon copy) field. It also describes the usual pitfalls, what exposed addresses allow a scammer to do, and the steps to follow after a mistake. The sources cited here do not describe how the To, Cc and Bcc fields work: this page therefore gives the conduct to follow, without going into the mechanics of the email software.
Straight answers
Why is a visible list of addresses a problem?
The GDPR defines a data breach as a breach of security leading, accidentally or unlawfully, to, among other things, the « divulgation non autorisée de données à caractère personnel » (unauthorised disclosure of personal data)1. The CNIL specifies that this covers any security incident, malicious or not, intentional or not1. A message in which all recipients appear in view of the others can therefore fall under this definition, even without any attack.
The CNIL cites a similar case: a third party informs the data controller that it has received an email containing information about another person, and provides proof of it. The controller must then be considered informed of the breach1.
What are the harvested addresses used for?
The sources cited here describe how attackers use information of this kind. The UK NCSC writes that criminals use information available online to make their phishing messages more convincing3. MITRE describes "phishing for information": messages sent to obtain information that can then be used to target a victim2. According to MITRE, the Kimsuky group used targeted phishing emails to gather information about its victims, including contact lists, in order to identify other targets2.
Phishing consists of posing as a trusted third party in order to obtain personal or banking data4.
Who is responsible for the mistake?
The GDPR obligations fall on the data controller, that is, the organisation, whether public or private and whatever its size1. For an employee, the useful point lies elsewhere: as soon as they notice the mistake, they report it internally, because it is the organisation that decides what happens next.
1How it works1 min
The GDPR text requires the data controller to notify a breach to the supervisory authority without undue delay and, where feasible, no later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of individuals6. The CNIL adds that this period starts when the controller has a reasonable degree of certainty that an incident has occurred and affected personal data1.
The level of risk determines the obligations1. With no risk, the organisation documents the incident internally in a register. With a risk, it documents it and notifies the CNIL. With a high risk, it documents it, notifies the CNIL and also informs the people concerned. Risk is assessed case by case, according to the nature and sensitivity of the data, how easily the people can be identified and their possible consequences1. A lone address and an address that reveals membership of a sensitive group are not judged the same way, but this assessment falls to the organisation, not to the sender.
2What you do2 min
Before sending a message to several external people:
- Place external recipients in the Bcc field, not in To or Cc.
- Check all three fields before sending: no external address should remain in To or Cc.
- If the message is sent often (newsletter, meeting notice), ask the IT team for a sending tool designed for this purpose rather than repeating the manual steps by hand.
After a mistake:
- Warn the DPO or the IT department immediately, with the subject of the message, the time it was sent and the number of recipients.
- Do not try to settle the matter alone by writing to the recipients: the organisation must first assess the risk.
- Keep the sent message. For phishing, Cybermalveillance.gouv.fr recommends keeping the evidence4. The same reflex serves here as the basis for documenting the incident.
On the organisation's side, the CNIL asks for the incident to be documented: nature of the breach, categories and approximate number of people concerned, likely consequences, measures taken or planned5. If there is doubt about the need to inform the people, the CNIL advises notifying it of the incident, and it will say whether they must be informed5. Notification is made through an online service dedicated to organisations5. If all the information is not available within the 72-hour period, an initial notification can be followed by a supplementary one5.
3Pitfalls1 min
- Forgetting Bcc: putting a single recipient in To, typing the others in Cc out of habit, or pasting the whole list into the wrong field. Checking the fields before sending is the safeguard.
- Forwarding or replying to all: before forwarding a message or replying to all, check which addresses appear in the fields.
- Believing the incident has no consequences: the addresses are already with third parties, and the NCSC points out that scammers use available information to make their messages more credible3. The recipients may therefore receive suspicious messages afterwards: the organisation can advise them not to reply to dubious messages and to report them to Signal Spam4.
The sources cited here report no dated case of a bulk email sent with visible addresses: this page therefore presents none.
Fact sheet
- Identifier
- CP-564
- Wing
- 5. Office life and reflexes
- Brain skill
- Outsmarting Social Engineering (outsmart_social_engineering)
- Brain reflex
- cr-041
- Diagram
- G5 · Employee Decision Tree
- Languages
- de, en, fr
- Sources
- 6 sources checked on 3 November 2026
Sources6 sources
- CNIL, “Violations de données personnelles : les règles à suivre”, 19 June 2018. https://www.cnil.fr/fr/violations-de-donnees-personnelles-les-regles-suivre (accessed 3 November 2026)
- MITRE ATT&CK, “Phishing for Information, Technique T1598 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1598/ (accessed 3 November 2026)
- NCSC (UK), “Phishing scams: how to spot and report them”, 26 November 2021. https://www.ncsc.gov.uk/collection/phishing-scams (accessed 3 November 2026)
- Cybermalveillance.gouv.fr, “Que faire en cas de phishing ou hameçonnage ?”, 10 January 2020. https://www.cybermalveillance.gouv.fr/tous-nos-contenus/fiches-reflexes/hameconnage-phishing (accessed 3 November 2026)
- CNIL, “Notifier une violation de données personnelles”, 24 May 2018. https://www.cnil.fr/fr/services-en-ligne/notifier-une-violation-de-donnees-personnelles (accessed 3 November 2026)
- CNIL, “CHAPITRE IV - Responsable du traitement et sous-traitant”. https://www.cnil.fr/fr/reglement-europeen-protection-donnees/chapitre4#Article33 (accessed 3 November 2026)
Cite this article
Brain, “Sending bulk email with Bcc”, Cyberpedia, 2026. https:/
BibTeX
@misc{brain_cp564_en_2026,
author = {Brain},
title = {Sending bulk email with Bcc},
year = {2026},
howpublished = {Cyberpedia},
url = {https://startbrain.io/cyberpedia/en/articles/bulk-email-bcc-hidden-recipients/},
note = {CC BY 4.0}
}