Crap happens, and it just happened to iContact.com
I've had a Google Apps Gmail account for a few years now, and I really like it. I never get spam, the large capacity is great and the interface and features can't be beat.
One of those features is a catch-all email address. That is, you can set up your email to receive all mail directed to any user at your domain. If you own example.com, you could have tom@example.com, dick@example.com and harry@example.com all come to your inbox.
Why would you do that, though?
One reason is to determine if any company you give your email address to leaks your address to other parties.
For example, you sign up for untrustyshop.com with the email address untrustyshop@example.com. If next week you notice a lot of advertisments coming to your inbox sent to untrustyshop@example.com, you know that untrustyshop.com has somehow mishandled your email address.
So I've been wondering why I was suddenly getting spam at two unique email addresses at my Google Apps domain. After a more detailed examination of previous messages to those addresses, I noticed both were sent by iContact. A Google search confirmed my suspicion that iContact.com's data had been compromised.
It seems, they lost their email list to hackers. They try to bury it in a bunch of other good-intentions drivel in their blog, but the key sentence is "Based on the information we have, the subscriber email address is the only data affected."
An embarrassing exhibition of incompetence in your professed area of expertise can't be good for business.
On the other handle, the great Google itself has had trouble recently with compromised data.
Security is hard.