The anti-fraud nonprofit Cifas inadvertently exposed the email addresses of dozens of individuals—including employees from security vendors, consultancies, publishing firms, and public sector entities (e.g., national government)—by sending a calendar invite with recipients listed in the To and CC fields instead of BCC. Over 15 addresses were visible in the To field and 45 in the CC field, violating data protection best practices. The Information Commissioner’s Office (ICO) classifies email addresses as personal data, and such exposures can reveal sensitive associations (e.g., fraud prevention roles, government ties) even without additional content leaks. While the ICO confirmed no breach report was filed by Cifas, the incident highlights systemic risks of human error in bulk communications, a recurring issue flagged by the regulator. The exposure undermines Cifas’ mission—'We protect your organisation from fraud and financial crime'—by ironically failing to safeguard stakeholders’ data in a basic operational process.