What Is This About?

In early 2026, a large-scale 'Email Bomb' attack exploited the Zendesk help desk feature allowing anonymous ticket creation. Attackers submitted thousands of fake support requests using victims' email addresses, triggering legitimate automatic email responses flood. This resulted in thousands of users receiving hundreds of unwanted emails purportedly from legitimate companies, including threatening messages falsely claiming FBI involvement. Zendesk itself was not breached; rather, its configuration allowed the abuse. The incident affected thousands of users and companies whose Zendesk instances were used as vectors. No sensitive data breach occurred, but users were spammed with PII-level emails.

What Happened?

In early 2026, a large-scale 'Email Bomb' attack exploited the Zendesk help desk feature allowing anonymous ticket creation. Attackers submitted thousands of fake support requests using victims' email addresses, triggering legitimate automatic email responses flood. This resulted in thousands of users receiving hundreds of unwanted emails purportedly from legitimate companies, including threatening messages falsely claiming FBI involvement. Zendesk itself was not breached; rather, its configuration allowed the abuse. The incident affected thousands of users and companies whose Zendesk instances were used as vectors. No sensitive data breach occurred, but users were spammed with PII-level emails.

What Information Was Impacted?

Upon information and belief, the following types of sensitive personal information may have been compromised:

• PII;
• Contact Info.

What Action Can You Take?

Levi & Korsinsky, LLP is investigating whether affected users are entitled to compensation. If you received a notice from Zendesk, Inc., there is no cost or obligation to participate. Follow the link below to find out about your rights and potential legal remedies available.