First Manufacturing Co. selling customer email addresses in violation of its own privacy policy

Today (July 18, 2026), I sent this email to orders@firstmfg.com, the customer support email address for First Manufacturing Co., which sells motorcycle riding gear, most notably vests and jackets:

Today I received marketing spam from info@leathernewyork.com.

The email address to which the spam was sent, [elided], which is also the address from which I am writing to you, is a unique, privacy-protecting email address which was only ever given to First Manufacturing Company, specifically when I placed orders through your website in March 2025.

I have reviewed your privacy policy and it discloses nothing about you sharing customer email addresses with third parties so they can send me spam.

I wonder, then, if you can please explain to me how leathernewyork.com got this email address, and how this could possibly be OK.

Thank you,

Jonathan Kamens

Literally one minute later, I received this reply:

Hi Jonathan,

We are sorry for the concern this caused. We understand why receiving marketing email at an address you only used with us would feel like a privacy issue.

Based on our published privacy information, we do share personal information with certain third parties that help operate our store, including Shopify and Google Analytics. Our privacy information also says we may use order information to communicate with you and to provide information or advertising about products or services.

That said, we do not have information here that explains the specific path for how leathernewyork.com obtained your address or whether that sender was using data shared directly by us. We cannot verify that from the information available to us.

If you would like, please forward the full email headers from the message you received so we can review the source more closely.

Thanks for bringing this to our attention.

First Manufacturing Company,
Customer Support by AI
Call: (800)-537-3030

I sent back the following:

Please escalate this ticket to a human being. I do  not wish an AI to reply to me again.

I am sure there are human beings at First Manufacturing Company who know how leathernewyork.com got their hands on my email address.

I am equally sure that this information is not shared with the AI that responds to customer support inquiries.

I do not want to deal with an AI, I want to deal with a human being.

I hope I have made myself clear.

this is after the quote

A minute later the AI replied again, disregarding my explicit statement that I did not want the AI to reply to me again:

Hi Jonathan,

I totally understand why you want a human review for this, especially since you believe the email address you received spam at was shared only with us when you ordered.

From our published privacy information, we do share personal information with certain third parties that help operate our store (for example, Shopify and Google Analytics), and we may use order information to communicate with you and provide information or advertising about products or services. However, the details available in this channel do not explain the specific path for how leathernewyork.com obtained your address in this case, or whether the sender used data shared directly by us.

A human teammate is going to take over now so they can look into what happened on your specific case.

Please forward the full email headers from the spam email you received so they can review the source more precisely.

Thanks for your patience as we escalate this.

First Manufacturing Company,
Customer Support by AI
Call: (800)-537-3030

I guess now we will have to wait and see if I actually get a response from a human being and if they actually admit to selling my email address without my consent in violation of their own privacy policy.

Having heard nothing back from the company, I attempted once again today to get their attention. After a few rounds of emails with the bot I finally got a response which I think probably came from a human being, though it was just about as useless as the responses I’d gotten from the bot. Here’s today’s email exchange, starting with email from First Manufacturing:

Hi Jonathan,

Thank you for reaching out to us.

I apologize for any frustration or concern this situation has caused. I have reviewed this matter thoroughly with both our technical team and management. We treat data privacy with the utmost seriousness, and our systems are strictly designed to ensure customer information remains secure and unbreached at all times.

We are committed to resolving your concerns. If you have any evidence, documentation, or screenshots indicating a potential breach, please share them with us directly. This will allow our technical team to investigate the situation thoroughly and address it right away.

Thank you for your cooperation and understanding.

The “evidence” I have is that an email address that I have literally only ever given to First Mfg received spam from a different company. I have already provided you with the evidence of that in the form of the email headers from the spam.

I didn’t ask whether your systems were breached.

I asked whether you sold my email address to another company, a question which your answer below does not address.

If you didn’t do that, then one of your employees stole your user list or your system was in fact breached even if you don’t know about it.

If you really didn’t sell your mailing list to Leather New York, then I’d say you owe me a thank you for notifying you that your security has been compromised.

I would like a straight answer about what happened here, not a butt-covering runaround.

Hi Jonathan,

I am really sorry for the frustration this situation has caused.

I want to clarify that First Manufacturing Co. has no affiliation or connection with Leather New York. Since you received an email directly from them, we strongly recommend reaching out to their team directly to inquire how they acquired your contact details.

Please be assured that protecting customer data is an absolute priority for us, and we maintain strict security measures to ensure your information is never shared or compromised on our end.

If you have any further questions or if there is anything else I can assist you with, please don’t hesitate to reach out.

Why are you giving me this grief.

I have already explained to you how I know that the only place Leather New York could have obtained my email address is from your customer database.

Here is that explanation again, from earlier in this thread:

“The email address to which the spam was sent, [elided], which is also the address from which I am writing to you, is a unique, privacy-protecting email address which was only ever given to First Manufacturing Company, specifically when I placed orders through your website in March 2025.”

Again: THIS EMAIL ADDRESS HAS NEVER BEEN GIVEN TO ANYONE OTHER THAN FIRST MANUFACTURING OR USED IN ANY CONTEXT OTHER THAN WHEN PLACING ORDERS ON THE FIRST MANUFACTURING WEBSITE.

As I said in my last email to you, the ONLY ways Leather New York could have obtained this address is if either (a) you gave or sold it to them, (b) someone on your staff stole it and gave or sold it to them (presumably along with many other email addresses), or (c) your IT assets have been compromised either by Leather New York or by someone else who then sold the address to Leather New York.

There is NO OTHER WAY LEATHER NEW YORK COULD HAVE OBTAINED THIS EMAIL ADDRESS. I ABSOLUTELY did not give it to them. I ABSOLUTELY never gave it to anyone other than First Manufacturing.

I don’t know how I can possibly be more clear about this. You are lying to me or your customer database has been compromised without your knowledge. I am urging you to figure out which of those options is the correct one.

Now we once again wait and see if they (a) go back to ignoring me, (b) continue to give me the runaround and claim it’s somehow my fault Leather New York got my email address, or (c) actually listen to what I’ve told them and put some effort into figuring out how their customers’ email addresses ended up in the hands of another company.

UPDATE [August 4, 2026]

In an email sent to me yesterday, First Manufacturing said they are investigating my report:

I want to sincerely apologize for any concern or inconvenience this situation has caused. Please be assured that we have shared all the details of your case with our dedicated technical security team, and they are actively looking into it.

We take data privacy very seriously, and we want to clarify that our preliminary review shows no information was leaked or shared through our servers to any third-party companies.

Our team will continue to handle this matter thoroughly. If we have any updates for you, we will follow up immediately. Please feel free to reach out if you have any additional questions in the meantime.

I wrote back today:

Regarding what you wrote below, “our preliminary review shows no information was leaked or shared through our servers to any third-party companies,” please stop telling me that.

The evidence is incontrovertible that Leather New York has in their possession an email address of mine which I only ever gave to First Manufacturing.

Therefore, at best what you can truthfully tell me is that you have been unable to determine how Leather New York got their hands on your customers’ emails.

“We can’t figure out how it happened” is not the same as “it didn’t happen.”

I don’t want to hear repeated denials which I know are false.

Thank you.