Attackers flood an inbox with hundreds or thousands of real signup emails to hide the one message that matters, like a bank fraud alert or a password reset. OpenEFA now recognises these floods as they start, holds them in quarantine, and keeps your important mail arriving.
Why it matters
Every message in a subscription bomb is legitimate: a real newsletter, a real store, a real welcome email that passes every authentication check. A filter that judges one email at a time has nothing to object to. The danger is the pattern, and the pattern is cover. While the victim deletes newsletters, the attacker is in a bank account, making a purchase or changing a password.
What changes for you
- On automatically. Every mailbox on our hosted MailGuard service is protected as of today, with nothing to configure. Deployments on your own premises receive it with their next update.
- Held, not deleted. The flood goes to quarantine. Anything you wanted is one click to release.
- The real mail gets through. Fraud alerts, password resets and receipts keep arriving in the inbox while the flood is held aside.
With EFAidentity, the flood is checked against the account
If you also use EFAidentity, a subscription bomb is now matched against what is happening to the same person's account. A flood plus a new sign-in, password reset or MFA change becomes one critical account-takeover alert, and the attacker's sessions are revoked automatically. See the EFAidentity November update.
If your inbox ever floods
- Check your bank and card accounts for charges you did not make.
- Look for password reset or “new sign-in” emails you did not ask for.
- Change your email password and turn on multi-factor sign-in.
- Contact your IT provider. If that is us, we can see the flood on our side.