Email extraction is the alleged removal of email-related data during an intrusion. The data may include mailbox contents, message headers, contacts, addresses, or exported lists from a mail system or related repository.
It matters because email data is operationally valuable. Even a small set of addresses can help attackers map an organization, impersonate staff, launch phishing, or pressure victims with credible extortion claims. In some cases, extracted mailboxes also reveal passwords, internal workflows, or sensitive attachments, increasing the impact beyond the raw message count.
In real attacks, email extraction can happen through mailbox compromise, account sync abuse, stolen tokens, API access, or data pulled from backups and archives. Defenders look for unusual export activity, mass message access, suspicious forwarding rules, and large outbound transfers. Limiting mailbox privileges, enforcing MFA, monitoring audit logs, and training users to spot phishing all help reduce the risk.