Here’s something most beginner website owners don’t find out until it’s too late: when you hand off your email list to a third-party service, you don’t hand off the responsibility that comes with it.
The FTC’s data breach response guide is pretty clear that businesses are expected to notify people when their personal information gets exposed — and email addresses count as personal information. It doesn’t matter that the breach happened on someone else’s servers. You collected that data. You made the call to store it somewhere. That decision is yours, and so is the fallout.
The FTC makes a similar point about email marketing law: even if you hire another company to handle your email campaigns, you can’t contract away your legal responsibility to comply with that law. The law sees through the outsourcing. You’re still the one accountable to your subscribers.
And this isn’t just a theoretical risk. Mailchimp has been targeted by real attackers who’ve stolen mailing lists — including subscriber names, email addresses, and usage data. Stanford University IT flagged one of these incidents, warning that attackers used stolen credentials to log directly into Mailchimp accounts and download entire lists. Your subscribers would have had no idea until someone told them.
Mailchimp’s own terms of use put it bluntly: they’re not responsible for losses from stolen or hacked passwords. So if a phishing attack tricks you into giving up your login, or someone compromises your account another way, the cleanup lands on you — not them.
So what does that mean practically? A few things worth knowing:
**You need to notify your subscribers.** If there’s a breach involving their data, most U.S. states have laws requiring you to tell affected people within a certain timeframe — though the exact rules vary by state, including who has to notify, how quickly, and what the notification must include. The FTC guide walks through what a breach notification should generally cover — things like what happened, what data was involved, and what people can do to protect themselves. Because state laws differ, talking to a lawyer is the safest way to know exactly what applies to you.
**Use strong, unique passwords for your email marketing accounts.** Since Mailchimp itself says it won’t cover you for hacked passwords, your login security is your first line of defense.
**Know what data you’re actually collecting.** A lot of people set up a signup form without thinking hard about what fields they’re asking for. The less sensitive data you collect, the less damage a breach can do.
If you’re building something — a newsletter, a small business site, a fan community — and you’re collecting emails, take five minutes to understand what you’ve signed up for legally. It’s not scary, but it is real.