Email Bomb Attacks: What They Are and How to Stop Them | 2Fifteen Tech | Apple Technical Partner

You open your inbox and find 800 new emails. Confirmation messages from services you never signed up for. Welcome emails from newsletters you’ve never heard of. Verification requests from platforms across the internet. Your inbox is essentially unusable — and that’s exactly the point.

Email bomb attacks (also called email flooding or registration bombing) aren’t new. They’ve been around since the late 1990s. But over the past year, they’ve come back in a big way — and they’re being used as a setup for much more damaging attacks.

How Email Bomb Attacks Work

The concept is simple: an attacker uses automated tools to sign up your email address for hundreds or thousands of online services simultaneously. Within minutes, your inbox is flooded with confirmation emails, welcome messages, and verification requests.

Each individual email is completely legitimate. That’s what makes these attacks so difficult to catch. Your spam filter isn’t going to block a real confirmation email from a real service. Multiply that by a thousand, and you’ve got a problem no traditional email security tool is designed to handle.

Why Attackers Do This

The inbox flood is rarely the end goal. It’s usually a means to something worse:

Hiding the real attack. If an attacker has compromised your credit card or initiated an unauthorized transaction, they want to bury the alert email under a mountain of noise. A fraud notification is easy to spot in a normal inbox. It’s invisible when it’s surrounded by 1,000 other messages.
Setting up a social engineering call. Some campaigns follow the email flood with a phone call from a fake IT help desk. The caller says they’ve noticed the attack and offers to help fix it. Once the victim grants remote access, the attacker deploys ransomware — Black Basta being one of the more common payloads.
Harassment. Some attacks are purely disruptive, targeting high-profile individuals or specific employees to render their email useless.

That second scenario is the one that should concern business leaders most. An employee drowning in a thousand unexpected emails is exactly the kind of person who’d accept help from someone claiming to be from IT.

Why Traditional Security Tools Miss This

Most email security products evaluate messages one at a time. They look for malicious links, suspicious attachments, known bad senders, or phishing language. An email bomb passes every one of those checks because each message is individually legitimate.

The attack only becomes visible when you look at the pattern: an abnormal volume of email arriving in a very short window, from a wide variety of unrelated sources. That requires a fundamentally different approach to detection — one that understands what “normal” looks like for each individual mailbox.

How We Protect Against Email Bomb Attacks

As a Material Security partner, we deploy and manage protections that go well beyond traditional email filtering. Here’s what that means in practice for our clients:

Detection based on behavior, not content. Material builds a historical profile of each mailbox’s normal email volume. When incoming messages spike well beyond that baseline, it flags the anomaly — even though none of the individual emails would trigger a conventional security alert. This detection is tailored per mailbox, so a surge that’s alarming for one employee isn’t confused with a naturally busy inbox elsewhere.

Automatic remediation, not just alerts. Detection alone doesn’t solve the problem. When an attack is identified, Material automatically filters the flood into a separate folder or label — including emails that arrived before the detection triggered. Legitimate messages from trusted contacts and internal senders are left in the inbox. The user sees the flood stop and the noise disappear within seconds.

No emails are deleted. The filtered messages are moved, not destroyed. If a legitimate email from an unfamiliar sender happened to arrive during the attack window, the user can still find it. This avoids the false-positive problem that makes aggressive filtering risky.

User notification. Affected employees can be automatically notified when an attack is detected and when it’s been resolved, so they understand what happened without needing to contact IT.

What to Do If You Suspect an Email Bomb Attack

If you or an employee suddenly receives a flood of unexpected emails, here’s what matters:

Don’t engage with the emails. Don’t click unsubscribe links or respond to confirmation messages — some may be crafted to verify your address or capture credentials.
Be suspicious of follow-up phone calls. If someone calls claiming to be from IT or a vendor offering help with the flood, verify their identity through a known channel before granting any access. This is a common social engineering play.
Alert your IT team immediately. The sooner the attack is identified, the sooner remediation can begin — and the sooner you can check whether the flood is covering up something else.
Check for signs of account compromise. Review recent login activity, forwarding rules, and any financial alerts that may have been buried in the noise.

Email Security Is More Than Spam Filtering

Email bomb attacks highlight a gap in how most businesses think about email security. Filtering out obviously malicious messages is important, but it doesn’t address threats that are made up entirely of legitimate emails. It doesn’t account for attacks that weaponize volume instead of content.

This is why we include Material Security as part of our managed security services. It gives our clients protection that works at the mailbox level — understanding context, detecting anomalies, and taking action automatically. Combined with the email authentication (SPF, DKIM, and DMARC) and phishing protection we already manage, it’s a more complete picture of what email security actually requires today.

Want to Talk About Your Email Security?

If you’re not sure how your business would handle an email bomb attack — or if you’re relying solely on your email provider’s built-in filtering — we should talk. These attacks are increasing in frequency, and the social engineering tactics that follow them are getting more convincing.