I have found my email address online in a .txt file. What should be my next step? [closed]

Question

A few days ago someone tried to log into my bank account, the attempt was unsuccessful but it was quite concerning. I’ve spent the past weekend moving my most important accounts to alternate emails and setting up TFA everywhere. I plan to get rid of my old email altogether since it was also used to sign up for some random websites and newsletters in the past weeks.

As a part of the clean up I’ve run a Google search for my email and found a .txt file online with my email and thousands of others. They were categorised as valid/invalid. The site was since taken down but I have screenshots.

I live in the E.U. and I’ve been thinking about a GDPR or a police report. The website owner was really easy to find and lives in the same country as me.

What should be a next step?

Answer 1

• Just the email in such a list is annoying but not really concerning. There are millions of people who put their email into publicly available contact data, and after a couple of years of use any email is going to be exposed some way. That's why websites use passwords in addition to just the email and why mail programs have spam filters.
• Your email was probably not used to sign up anywhere. Instead, spammers pretend that you signed up to slow attempts to prosecute them. A bit of a joke, really, considering how hard it is to prosecute spammers. The valid/invalid remark is used to facilitate spamming, no need to send mails to long-inactive addresses.
• More concerning than a 'leak' of your email would be a leak of your email plus password. (Such things also happen, and they are a reason why one should use different passwords and 2FA/MFA on important sites.) If it is just the email, see my first bullet point.
• There is a significant likelihood that the 'website owner' you think you identified is another victim of the address trader. Getting to the real culprit will require significant forensic effort. That effort is unlikely to happen for just emails.