Deleteduser.com — a $15 PII Magnet

What happened

It has been reported that security writer Mike Sheward bought the domain deleteduser.com after seeing a thread about apps overwriting deleted accounts with addresses like something@deleteduser.com. He allegedly set up a mailbox and — surprise — started receiving routable emails within an hour. The messages reportedly came from dozens of services that expected the placeholder to never be delivered.

What the inbox revealed

The haul, it has been reported, included emails from a large chain of gyms, a hospitality management platform, an HR SaaS tool, a delivery service, a major energy company, an uptime-monitoring SaaS and two cybersecurity firms. Many messages allegedly contained original personal data: guest names and room numbers, shipment tracking and contact details, purchase-order data, and even password‑reset emails with valid tokens. Ouch. That’s not just sloppy; it’s the exact opposite of “forget me.”

Why this keeps happening

This is a classic engineering compromise meeting new privacy law realities. Systems built to grow typically weren’t designed to actually delete rows — referential integrity, analytics, unique-id reuse: it’s messy. So teams overwrite user fields with garbage but keep records intact. The unintended consequence? If that garbage is a routable domain someone else can buy, all that “deleted” personal data suddenly lands in somebody else’s inbox. Whoops.

The takeaway

Two quick lessons: don’t rely on third‑party placeholders you don’t control, and don’t mistake overwriting for true deletion. Regulators pushed deletes for a reason — privacy isn’t served by a brittle checklist. Want to sleep at night? Use non‑routable placeholders, cryptographic erasure where feasible, and audit your delete flows. Otherwise, your “right to be forgotten” might just become someone else’s $15 data jackpot.

Sources: mike-sheward.medium.com, Lobsters