Email Caused 64% of a Province's Privacy Breaches

Ransomware gets the headlines. Then a provincial regulator publishes a quarter of raw numbers and the leading cause of breached personal data turns out to be somebody typing three letters into a To field and clicking the first suggestion. Newfoundland and Labrador reported 53 public sector privacy breaches for the quarter ending June 30, 2026. Email was involved in 64% of them. That is not a story about attackers. It is a story about the interface people use eight hours a day.

Key Takeaways

• Newfoundland and Labrador's Office of the Information and Privacy Commissioner reported 53 privacy breaches between April 1 and June 30, 2026, up from 46 the previous quarter, in data published July 27, 2026.
• Email accounted for 64% of those 53 incidents across 18 public bodies, the largest breach vector in the dataset by a wide margin.
• Verizon's 2026 Data Breach Investigations Report public sector snapshot independently found that "misdelivery accounts for 88% of all errors in the Public Sector," with the next most common error type at just 4%.
• The IAPP's analysis of the Newfoundland data argues these incidents are workflow design failures rather than training failures, because "training has natural limits."
• The fixes that work are structural: external recipient warnings, distribution list audits, longer undo send, and approval steps on bulk mailings.

What Did the Newfoundland Report Actually Find?

Fifty three privacy breaches were reported to the province's Office of the Information and Privacy Commissioner between April 1 and June 30, 2026, up from 46 in the previous quarter, with email involved in 64% of them.

Sit with the arithmetic. Fifty three incidents across a 91 day quarter is one reported privacy breach roughly every 41 hours, from 18 public bodies in a province smaller than most North American cities. These are not sophisticated compromises. They are clerks, nurses and administrators sending correspondence that landed somewhere it should not have.

The direction matters more than the count. Reported breaches went up, not down, in a jurisdiction that has run privacy training for years. Rising numbers can signal a better reporting culture rather than worse practice, and an honest reading holds both. What cannot be explained away is the composition: whatever else changed, email stayed on top.

Why Is Email Still the Top Breach Vector?

Because email is the only system in a modern office where an irreversible disclosure to an arbitrary stranger is one keystroke away, with no confirmation step and no undo beyond a few seconds.

Break the failure modes apart and every one is an interface problem wearing a human error costume:

• Autocomplete collisions. Two contacts share a surname, and the client suggests the one you emailed most recently in the same grey text as the right one.
• Distribution lists nobody audits. A 2019 group alias still contains a contractor who left in 2022. The sender sees a list name, not 340 addresses.
• Reply all on a thread that grew. An external party joined at message nine. Message fourteen contains the case details.
• Attachments carrying more than they show. Hidden spreadsheet columns, unredacted PDF layers, a merged letter with the wrong row.
• Bulk mailings. Recipients pasted into To or Cc instead of Bcc, exposing every address to everyone.

Verizon reached the same conclusion from a different dataset. Its 2026 DBIR public sector snapshot describes an "unusually high rate of internal incidents driven by Miscellaneous Errors, specifically Misdelivery due to the sheer volume of correspondence," and notes it is "surprisingly easy to make an off by one error and send it to the wrong person."

Is One Province Representative?

On its own, no, and the IAPP analysis says so plainly. But independent datasets converge on the same finding, which is why the Newfoundland number deserves a close read rather than dismissal as a small sample.

Verizon's 2026 DBIR examined more than 31,000 real world security incidents across 145 countries, over 22,000 of them confirmed breaches. Within Public Administration, the Miscellaneous Errors pattern appears in 31% of instances, which Verizon calls "considerably higher here than in most other verticals." The second place error variety, classification error, sits at 4%. This is not a close race.

The UK regulator points the same way. The Information Commissioner's Office maintains "data emailed to incorrect recipient" as a named category in its data security incident trends dataset, and across successive quarterly releases it has repeatedly ranked as the most reported non cyber incident type. The provincial caveat is real; the pattern it sits inside is not in dispute. On how the profession sees its own gaps, see our summary of the ISACA State of Privacy 2026 findings.

What This Means for Your Inbox

If you have ever received an email clearly meant for someone else, you have been on the receiving end of this statistic. The uncomfortable half is the version you never find out about: the message carrying your medical appointment, your benefits file or your legal correspondence, delivered to a stranger with a similar surname and logged as one line item in a quarterly report.

Misdirected email also has a longer tail than most breach types. A ransomware incident ends when systems are restored. An email sitting in an unintended recipient's archive has no expiry, no revocation and no audit trail, and the sender usually cannot confirm it was ever deleted. That is why regulators treat one misdirected message containing sensitive personal information as a reportable breach rather than a clerical slip.

Privacy law is moving toward reporting with teeth on exactly this. Canada's Bill C-36, which replaces PIPEDA with penalties up to $10 million, raises the cost of the mistakes the Newfoundland report catalogues. Email is not the only leaking channel either: the Nextcloud leak that exposed 367,000 client files and email addresses came from a misconfiguration, another failure of defaults rather than attention.

What Actually Reduces Misdirected Email?

Controls that change the sending workflow, not posters that ask people to be more careful. Four measures do most of the work:

1. Turn on external recipient warnings. Google Workspace ships these on by default, warning when a message goes to an external address not in your contacts or directory, per Google's admin documentation on Gmail external recipient warnings. Administrators find it under Apps, Google Workspace, Gmail, End User Access. Verify nobody switched it off to reduce complaints.

2. Audit distribution lists on a schedule. Every group alias needs a named owner and a recurring membership review. Publish the member count next to the alias so senders see the blast radius before they hit send.

3. Add friction to bulk sends specifically. Verizon points directly at "the sheer volume of correspondence" as the driver in public administration. Require a second approver above a recipient threshold, enforce Bcc for multi recipient external mail, and test send to an internal address first. The delay costs minutes; the alternative costs a regulatory filing.

4. Use undo send and set it to the maximum. Gmail's undo send window defaults to five seconds and can be raised to 30 in settings. Thirty seconds is long enough to notice the wrong avatar in the recipient chip, which is the exact moment most people spot the error. A small control that maps precisely to how the mistake is actually discovered.

The Bottom Line

The standard response to a misdirected email is to retrain the sender. Newfoundland's numbers, alongside Verizon's finding that misdelivery accounts for 88% of public sector errors, make that look like a category mistake. You cannot train away a design that lets an irreversible disclosure happen faster than a person can read what they typed.

Every fix above is an existing setting or a scheduled review. None require new software or a budget cycle. Email still leads the breach charts after fifteen years of awareness campaigns not because people stopped paying attention, but because almost nobody changed the workflow they are paying attention inside of.

Sources: IAPP, What Newfoundland and Labrador's breach data says about email risk, Verizon, 2026 Data Breach Investigations Report Public Sector snapshot, Office of the Information and Privacy Commissioner, Newfoundland and Labrador, UK Information Commissioner's Office, Data security incident trends, and Google Workspace Help, Control Gmail external recipient warnings.