A Global Address List (GAL) is the organization-wide directory used by email systems to store users, mail-enabled contacts, and sometimes distribution groups. It helps people find coworkers and route messages inside the domain, but it also exposes valuable identity data: names, titles, departments, aliases, and internal naming patterns.
In cyber security, the GAL matters because attackers can abuse it after gaining access to a mail session or directory service. If they can browse or export the list, they can map the organization, identify high-value employees, and build convincing spear-phishing lures. The GAL can also reveal who reports to whom, which helps attackers impersonate trusted senders and target password resets, MFA prompts, or business email compromise campaigns. Defenders should treat directory access as sensitive, monitor bulk queries and exports, and limit what unauthenticated or partially trusted sessions can learn from the email platform.