Email bombing is an attack that floods one inbox with hundreds or thousands of messages in a short time, mostly sign-up confirmations and newsletters from real websites. The flood is rarely the point. It buries an alert you need to see, like a password change or a payment notice, or it sets up a call from someone posing as your IT help desk who offers to clean it up.
If it’s happening to you right now, start with one rule: don’t let anyone you didn’t call connect to your computer.
Talk to an advisor
Ask about your own setup.
We ask what you’re trying to accomplish and tell you what we’d look at first. It costs nothing to talk, and no price comes up on this call.
What an email bombing attack looks like
Most of the messages are real. The attacker, or a script, types your address into hundreds of sign-up forms, and each site sends its welcome email or confirmation link. Because the senders are legitimate, many of the messages get past spam filters. Proofpoint describes floods of more than 1,500 messages an hour (Proofpoint, 2025).
Watch for these in the middle of the noise:
- 01A “password changed”, “new sign-in” or “security info updated” alert you don’t recognize.
- 02A purchase, wire transfer, payroll or bank change notice from a service you use.
- 03A call, text or Microsoft Teams message from “IT support” soon after the flood starts, offering to fix it.
Why attackers flood an inbox
To hide something
An inbox with 3,000 new messages is one where nobody notices the one that matters. Proofpoint’s examples are a “password changed” alert and a “wire transfer initiated” notice buried in the flood. By the time someone finds them, the account is locked or the money has moved.
To set up a fake help desk call
Microsoft documented a group it calls Storm-1811 doing exactly this in 2024. It signed targets up for large numbers of email subscriptions, then called them posing as IT support and offered to fix the spam. By late May 2024 it was also reaching people through Microsoft Teams, from accounts with names like “Help Desk” and “IT Support” (Microsoft, May 2024).
On the call, the “technician” talked people into starting Quick Assist, the remote help tool built into Windows, and handing over control of their screen. Then the group installed its own tools. In several cases, Microsoft says, it ended in Black Basta ransomware across the network.
The flood makes the call believable. You really do have a spam problem, and someone is offering to solve it. That’s why the call is the part to defend against.
1,500+ an hour
How many messages a subscription bombing attack can deliver to a single inbox, according to Proofpoint’s December 2025 description of these attacks (Proofpoint).
What to do if your inbox is being flooded
- Don’t accept help you didn’t ask for. If someone calls, texts or messages you in Teams offering to fix the spam, end the conversation and call your IT provider at the number you already have. Don’t start Quick Assist, install anything, read out a code or approve a sign-in for them.
- Tell IT right away. Say when the flood started and whether anyone has contacted you about it. Report it before you start cleaning up.
- Search the pile before you delete it. Look for password changes, new sign-ins, sign-in method changes, purchases, and bank or payroll notices.
- Check those accounts directly. Open the bank, payroll or vendor site in your browser yourself, not through a link in the flood, and look for changes you didn’t make.
- Let filtering catch up. Microsoft 365 has mail bombing detection in Exchange Online Protection, on by default since mid-2025. Messages it identifies go to the Junk folder (Microsoft, 2025). IT can also add rules to move the confirmations out of your way.
How to prevent email bombing from turning into a breach
You can’t stop someone from typing your address into sign-up forms. You can make sure the flood doesn’t lead anywhere:
Give staff one way to reach IT
If everyone knows they call IT, and IT doesn’t ask strangers for remote access, an unexpected “help desk” call stands out.
Limit outside Teams messages
By default, Teams allows chat with every external domain. Admins can allow only the domains you work with, and every other domain is blocked (Microsoft Learn).
Remove remote tools you don’t use
Microsoft recommends blocking or uninstalling Quick Assist and similar tools where they aren’t needed.
Require stronger sign-in for important apps
Microsoft recommends Conditional Access rules that require phishing-resistant sign-in methods, so a password or code read out over the phone isn’t enough.
What we do for our clients
When a client calls us, the call rings our technicians, and an engineer owns each client account. Staff know who IT is, which makes a stranger claiming to be IT easier to spot.
Computers run detection backed by a 24/7 security operations center that can isolate a device from the network. We run phishing simulations, and we review your Microsoft 365 settings with you in your technology business review. Staff at our clients have still clicked phishing emails, so we plan for that too.
If your inbox is filling up right now, call us at (225) 273-1206 before you take a call from anyone else. Otherwise, book a 15-minute call and we’ll check who outside your company can message your staff in Teams today. See our cybersecurity services for how we work.
Related reading
Frequently asked questions
What is email bombing in cyber security?
It’s a denial-of-service attack on one person’s inbox: the attacker signs the address up for so many emails that real messages get lost. In cyber security it’s treated as a cover tactic, because it often hides an account takeover or sets up a fake IT support call.
How long does email bombing last?
It varies. The sign-ups usually happen in one burst, but confirmations and newsletters from slower sites can keep arriving for days afterward. Filtering that recognizes the pattern, such as Microsoft 365’s mail bombing detection, moves most of it to Junk while IT adds rules for the rest.
How do you stop an email bomb?
You can’t undo the sign-ups, but you can keep them out of the inbox. Report it to IT, let filtering and inbox rules move the messages, and check your accounts for changes the flood may be hiding. Never let someone who calls offering to stop it connect to your computer.
How can you prevent email bombing?
Nobody can stop strangers from entering your address into forms. Prevention means limiting the damage: mail bombing detection turned on, outside Teams chat limited to domains you trust, unused remote tools removed, and staff who know exactly how IT will contact them.
Sources
- Microsoft Threat Intelligence, Threat actors misusing Quick Assist in social engineering attacks leading to ransomware (May 15, 2024)
- Proofpoint, Subscription bombing hides real cyberattacks (December 2025)
- Microsoft Tech Community, Protection against email bombs with Microsoft Defender for Office 365 (June 2025)
- Microsoft Learn, Manage external meetings and chat in Microsoft Teams
Next step
Let us handle this for you.
Email sign-ins watched, fake email rejected, staff phishing tests and a security operations center.
- 15 minutes
Tell us which question brought you here and how your office runs.
We’ll tell you how it applies to you and what we’d look at first.
If we’re not the right fit, we’ll say so.
15 minutes
