This is an automated archive made by the Lemmit Bot.

The original was posted on /r/tifu by /u/Comfortable_Damage20 on 2026-07-26 23:28:57+00:00.

I do cold outbound for a b2b company and a big part of the job is emailing lists of prospects, which normally goes out one address at a time through a proper sending tool.

So every person only ever sees their own name in the [to] line and never has any clue they're one of a few hundred getting the same note.

This week i was moving too fast through my morning and figured i'd just fire off a smaller batch by hand from my own inbox to save 10 minutes, so i pasted the whole list into a single email, and because i was rushing i dropped every address into the [to] field instead of BCC and hit send without looking twice.

The list itself was clean, i can't even remember whether it got verified through FullEnrich or Apollo that week, but it was solid, which is what turned a small slip into a properly bad afternoon, because it meant several hundred real people just landed in each other's inboxes all at once.

The replies started coming in fast, some people politely asking who i was and how to get off the list, a few of them a lot less politely pointing out that i'd just handed their work email to a room full of strangers and competitors.

And then one helpful guy replied-all to ask everybody to please stop replying-all, which naturally made it drag on even longer.

Then my manager got a forwarded copy from someone at a target account we'd been chasing for months, with a short note asking whether this was really how we handled people's data.

So i spent the rest of the day writing apologies and killing the campaign before sitting down with our ops lead to explain why a clean and fairly expensive list was now a few hundred people who will never want to hear from us again.

TL;DR: i manually sent a prospect list using "to" instead of “BCC”, exposed everyone's work email to each other and to our competitors, blew up a target account we'd chased for months, and turned a good list into a permanent do-not-contact pile, all because i didn't check one field before i hit send.