Mailchimp Security Breach Fixes: What Every Marketer Needs to Know

If you are currently using Mailchimp to send newsletters to customers, take a second to pause and ask yourself: how well protected is the subscriber data resting in your hands? And if the platform you trust is compromised, what will you do in the next 72 hours?

The story of Mailchimp's data security over recent years is a slightly painful reminder. Not because it is unfamiliar, but because it closely mirrors what anyone doing email marketing might face: a major platform, deep trust, and a small crack capable of shaking everything.

Three Public Disclosures, One Significant Crack

Since 2022, Mailchimp's security team has disclosed three incidents related to privacy and security. In April 2022, they confirmed a data leak affecting 319 customers. Four months later, another incident compromised an additional 216 accounts.

A few hundred accounts might sound small for one of the world's largest email platforms. But the way the breach spread is the thought-provoking part. In the August 2022 incident, one of the affected accounts was WooCommerce—a platform powering over 5 million online stores through its WordPress plugin. When a leak opens the door to millions of end users, it is no longer just "a few hundred accounts."

Why Email Lists Are High-Value Targets

Think about what an email list actually contains. It is not just email addresses. For many businesses, it is a customer behavior map: who buys what, who frequently opens emails, and who is about to churn. To bad actors, this is raw material for building hyper-realistic phishing campaigns.

• High Quality: Subscribers already care about the brand, resulting in much higher open and response rates compared to floating lists.
• Legitimate Sending Rights: Gaining control of an account allows bad actors to send emails from authenticated domains, making it difficult for recipients to distinguish between real and fake.
• Ripple Effect: A single platform customer can be the gateway to millions of others. The damage does not stop at just one account.

That is why a platform's privacy information is not merely a technical matter. Readers do not distinguish between a "platform error" and "your error"—they only see emails arriving from your brand.

What Mailchimp Did to Win Back Trust

Mailchimp's leadership has shown that they understand the severity of the situation. The platform was among the first to join the EU-US Privacy Shield framework, committing to annual privacy and security verifications starting in 2016. When this framework was invalidated in 2020, they continued to meet similar certification standards. Concurrently, they participate in mechanisms allowing European users to transfer data abroad in compliance with GDPR, via a data processing addendum built right into the terms of use.

The most visible step was the implementation of mandatory domain authentication in February 2024. Previously, Mailchimp only encouraged rather than required it, allowing unauthenticated users to send emails from any address, including free mailboxes. Consequently, spam surged and list abuse became widespread. Since February 2024, users sending over 5,000 emails are required to authenticate their domains.

For marketers, this change is both annoying and welcome: annoying because of an extra technical step, and welcome because customer inboxes have less junk—and your emails are less likely to get buried.

The Intuit Acquisition: Confusing Yet Logical

In late 2021, Intuit—the parent company of QuickBooks and TurboTax—acquired Mailchimp. The deal raised eyebrows in the industry since Intuit is traditionally a financial, accounting, and tax software company rather than a marketing player.

Upon closer inspection, the logic is clear: over 50% of small businesses fail within their first five years, which directly impacts Intuit's core business lines. If customers cannot sell products, they do not need accounting software either. On its part, Intuit boasts excellent security ratings and the resources to maintain high security standards for its subsidiary brands. What marketers should keep in mind is data movement: when a marketing platform shares an ecosystem with tax and accounting tools, the question of how data is used becomes even more critical.

Four GDPR Principles That Should Apply to Every Email Platform

Regardless of which platform you choose, privacy is an active and continuous process, not a completed checklist box. Businesses with European subscribers must comply with GDPR. However, as third-party cookies gradually disappear and consumers become more aware of their rights, many brands choose GDPR as the minimum standard for all markets.

1. Right to Erasure: Giving users the ability to delete all data associated with their name or contact details.
2. Right of Access: Users have the right to ask what their data is used for, where it is stored, and receive a personalized report for free.
3. Right to be Informed: Notifying users within 72 hours of discovering a breach. If the platform notifies you, forward that notice to your subscribers.
4. Right to Data Portability: When requested by users, data must be exportable in an accessible format—Mailchimp uses .csv, and most other platforms do too.

These four principles are not just for regulatory compliance. They force you to answer a question that many marketing teams overlook: who does this data actually belong to, and why are we holding onto it?

Declining Market Share and Lessons in Trust

In 2023, Mailchimp's market share dropped by 6% to 66.7%—nearly 20 points lower than its peak of 80%. The cause is not entirely tied to privacy concerns, as the market now features over 175 competing email marketing platforms. However, it is hard to argue that data leaks played no role in customers' decisions to switch.

To be fair: Mailchimp's proactive enforcement of domain authentication, maintenance of privacy certifications, and transparent disclosure of incidents show that they chose to face issues head-on rather than stay silent. Not every platform does that.

Ultimately, data only has value when people believe it is kept secure. No matter how pristine an email list is, it becomes meaningless if subscribers no longer trust you enough to open your emails.

This week, try a small task: log into the settings of the email platform you use, check if your domain is authenticated, and review whether you are storing any truly unnecessary data. Those small steps are often what preserve trust the longest.

And this is where I want to hear your thoughts: in your opinion, does the responsibility of protecting customer data lie with the platform or with the marketers themselves? I see many people blaming the platform entirely, but there is also a perspective that we are the ones who decide what to collect and how long to keep it. What do you think? Leave a comment—I would love to read your perspective.