First Manufacturing Co. selling customer email addresses in violation of its own privacy policy

Today (July 18, 2026), I sent this email to orders@firstmfg.com, the customer support email address for First Manufacturing Co., which sells motorcycle riding gear, most notably vests and jackets:

Today I received marketing spam from info@leathernewyork.com.

The email address to which the spam was sent, [elided], which is also the address from which I am writing to you, is a unique, privacy-protecting email address which was only ever given to First Manufacturing Company, specifically when I placed orders through your website in March 2025.

I have reviewed your privacy policy and it discloses nothing about you sharing customer email addresses with third parties so they can send me spam.

I wonder, then, if you can please explain to me how leathernewyork.com got this email address, and how this could possibly be OK.

Thank you,

Jonathan Kamens

Literally one minute later, I received this reply:

Hi Jonathan,

We are sorry for the concern this caused. We understand why receiving marketing email at an address you only used with us would feel like a privacy issue.

Based on our published privacy information, we do share personal information with certain third parties that help operate our store, including Shopify and Google Analytics. Our privacy information also says we may use order information to communicate with you and to provide information or advertising about products or services.

That said, we do not have information here that explains the specific path for how leathernewyork.com obtained your address or whether that sender was using data shared directly by us. We cannot verify that from the information available to us.

If you would like, please forward the full email headers from the message you received so we can review the source more closely.

Thanks for bringing this to our attention.

First Manufacturing Company,
Customer Support by AI
Call: (800)-537-3030

I sent back the following:

Please escalate this ticket to a human being. I do  not wish an AI to reply to me again.

I am sure there are human beings at First Manufacturing Company who know how leathernewyork.com got their hands on my email address.

I am equally sure that this information is not shared with the AI that responds to customer support inquiries.

I do not want to deal with an AI, I want to deal with a human being.

I hope I have made myself clear.

this is after the quote

A minute later the AI replied again, disregarding my explicit statement that I did not want the AI to reply to me again:

Hi Jonathan,

I totally understand why you want a human review for this, especially since you believe the email address you received spam at was shared only with us when you ordered.

From our published privacy information, we do share personal information with certain third parties that help operate our store (for example, Shopify and Google Analytics), and we may use order information to communicate with you and provide information or advertising about products or services. However, the details available in this channel do not explain the specific path for how leathernewyork.com obtained your address in this case, or whether the sender used data shared directly by us.

A human teammate is going to take over now so they can look into what happened on your specific case.

Please forward the full email headers from the spam email you received so they can review the source more precisely.

Thanks for your patience as we escalate this.

First Manufacturing Company,
Customer Support by AI
Call: (800)-537-3030

I guess now we will have to wait and see if I actually get a response from a human being and if they actually admit to selling my email address without my consent in violation of their own privacy policy.

UPDATE [July 31, 2026]

Having heard nothing back from the company, I attempted once again today to get their attention. After a few rounds of emails with the bot I finally got a response which I think probably came from a human being, though it was just about as useless as the responses I’d gotten from the bot. Here’s today’s email exchange, starting with email from First Manufacturing:

Hi Jonathan,

Thank you for reaching out to us.

I apologize for any frustration or concern this situation has caused. I have reviewed this matter thoroughly with both our technical team and management. We treat data privacy with the utmost seriousness, and our systems are strictly designed to ensure customer information remains secure and unbreached at all times.

We are committed to resolving your concerns. If you have any evidence, documentation, or screenshots indicating a potential breach, please share them with us directly. This will allow our technical team to investigate the situation thoroughly and address it right away.

Thank you for your cooperation and understanding.

The “evidence” I have is that an email address that I have literally only ever given to First Mfg received spam from a different company. I have already provided you with the evidence of that in the form of the email headers from the spam.

I didn’t ask whether your systems were breached.

I asked whether you sold my email address to another company, a question which your answer below does not address.

If you didn’t do that, then one of your employees stole your user list or your system was in fact breached even if you don’t know about it.

If you really didn’t sell your mailing list to Leather New York, then I’d say you owe me a thank you for notifying you that your security has been compromised.

I would like a straight answer about what happened here, not a butt-covering runaround.

Hi Jonathan,

I am really sorry for the frustration this situation has caused.

I want to clarify that First Manufacturing Co. has no affiliation or connection with Leather New York. Since you received an email directly from them, we strongly recommend reaching out to their team directly to inquire how they acquired your contact details.

Please be assured that protecting customer data is an absolute priority for us, and we maintain strict security measures to ensure your information is never shared or compromised on our end.

If you have any further questions or if there is anything else I can assist you with, please don’t hesitate to reach out.

Why are you giving me this grief.

I have already explained to you how I know that the only place Leather New York could have obtained my email address is from your customer database.

Here is that explanation again, from earlier in this thread:

“The email address to which the spam was sent, [elided], which is also the address from which I am writing to you, is a unique, privacy-protecting email address which was only ever given to First Manufacturing Company, specifically when I placed orders through your website in March 2025.”

Again: THIS EMAIL ADDRESS HAS NEVER BEEN GIVEN TO ANYONE OTHER THAN FIRST MANUFACTURING OR USED IN ANY CONTEXT OTHER THAN WHEN PLACING ORDERS ON THE FIRST MANUFACTURING WEBSITE.

As I said in my last email to you, the ONLY ways Leather New York could have obtained this address is if either (a) you gave or sold it to them, (b) someone on your staff stole it and gave or sold it to them (presumably along with many other email addresses), or (c) your IT assets have been compromised either by Leather New York or by someone else who then sold the address to Leather New York.

There is NO OTHER WAY LEATHER NEW YORK COULD HAVE OBTAINED THIS EMAIL ADDRESS. I ABSOLUTELY did not give it to them. I ABSOLUTELY never gave it to anyone other than First Manufacturing.

I don’t know how I can possibly be more clear about this. You are lying to me or your customer database has been compromised without your knowledge. I am urging you to figure out which of those options is the correct one.

Now we once again wait and see if they (a) go back to ignoring me, (b) continue to give me the runaround and claim it’s somehow my fault Leather New York got my email address, or (c) actually listen to what I’ve told them and put some effort into figuring out how their customers’ email addresses ended up in the hands of another company.

UPDATE [August 4, 2026]

In an email sent to me yesterday, First Manufacturing said they are investigating my report:

I want to sincerely apologize for any concern or inconvenience this situation has caused. Please be assured that we have shared all the details of your case with our dedicated technical security team, and they are actively looking into it.

We take data privacy very seriously, and we want to clarify that our preliminary review shows no information was leaked or shared through our servers to any third-party companies.

Our team will continue to handle this matter thoroughly. If we have any updates for you, we will follow up immediately. Please feel free to reach out if you have any additional questions in the meantime.

I wrote back today:

Regarding what you wrote below, “our preliminary review shows no information was leaked or shared through our servers to any third-party companies,” please stop telling me that.

The evidence is incontrovertible that Leather New York has in their possession an email address of mine which I only ever gave to First Manufacturing.

Therefore, at best what you can truthfully tell me is that you have been unable to determine how Leather New York got their hands on your customers’ emails.

“We can’t figure out how it happened” is not the same as “it didn’t happen.”

I don’t want to hear repeated denials which I know are false.

Thank you.

UPDATE [August 22, 2026]

I suppose it goes without saying that I haven’t heard anything back from First Manufacturing since I sent them the email quoted above. However, yesterday I got spam from another leather merchant sent to the same unique email address I only ever gave to First Manufacturing, and what’s more, this new spam made it clear in the header that they got my address from First Manufacturing. Here’s the email I just sent them:

I am still waiting for an answer to the question of how Leather New York got their hands on an email address which I only ever gave to First Manufacturing.

Furthermore, yesterday I received another spam message sent to that email address from a different leather vendor. Not only that, but that spam message makes it clear in its own header that they got my email address from First Manufacturing. Here’s the header:

From: USA Leather Shop via Faire <sales+firstmanufacturing@brand.faire.com>
Reply-To: Adam Smith <keekapi@gmail.com>
To: Jonathan Kamens <[elided]@anonaddy.com>
Subject: 20% OFF Wholesale Leather Products - Limited Time Offer
Message-ID: <[elided]@mtasv.net>
List-Unsubscribe: <https://www.faire.com/api/v2/brands/b_80vl3zpxd4/crm/customers/emails/one-click-unsubscribe?customerToken=[elided]&oet=[elided]>
List-Unsubscribe-Post: List-Unsubscribe=One-Click
Received: from mta121-ab1.mtasv.net (mta121-ab1.mtasv.net [50.31.205.121])
 by mail2.anonaddy.me (Postfix) with ESMTPS id [elided] for
 <[elided]@anonaddy.com>; Sat, 22 Aug 2026 00:50:42 +0000 (UTC)
Received: from ip-172-26-33-208.us-east-2.compute.internal (172.26.33.208) 
 by production-pmta-useast2.internal.postmarkapp.com (KumoMTA 10.97.242.240)
   with ESMTP id [elided] for
 <[elided]@anonaddy.com>;  Sat, 22 Aug 2026 00:50:35 +0000
MIME-Version: 1.0
Date: Sat, 22 Aug 2026 00:50:47 +0000
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: quoted-printable

Note the part of the From line in this header which I’ve helpfully demarcated in bold. They used a return address which specifically designates that this email was sent to a customer list obtained from the First Manufacturing website.

Note also the Reply-To line above which I’ve also bolded. Maybe if you honestly don’t know how people are getting their hands on your customer list, you should ask that guy.

Or you could just keep claiming your customer list hasn’t been stolen or intentionally shared with anyone, despite the mounting evidence which proves that’s obviously not true.

Jonathan Kamens

I also posted a review on Google Maps.

But wait, there’s more…

From some additional research I did after sending the email above, I think it is distinctly possible that “USA Leather Shop” and “First Manufacturing” are actually the same company. They still shouldn’t be spamming me from “USA Leather Shop”, because (a) their Privacy Policy doesn’t say they share email addresses with affiliated brands and (b) the footer of the spam referenced above says, “You’re receiving this because you subscribed to USA Leather Shop updates,” which is simply a lie.

If USA Leather Shop isn’t just different branding for the same company, the whoever is running it is aggressively ripping off First Manufacturing. Check out this text from First Manufacturing’s about page:

In 1987, a young man  arrived in New York City with a suitcase full of leather and a vision most would call crazy. The motorcycle world was hungry for quality gear, jackets and vests built for the road, not the runway, but the market offered only overpriced labels or cheap imitations. There had to be a middle ground: premium craftsmanship at an honest price.

That suitcase didn’t stay packed for long.

What started in small NYC workshops quickly grew into something bigger. Word spread through bike shops, rally grounds, and clubhouses. Riders talked. First MFG Co earned its reputation one jacket at a time, one satisfied customer at a time, one mile at a time.

Compared to this text from the “USA Leather Shop” storefront on faire.com:

“USA Leather Shop started in 2017 with a suitcase full of leather and an American Dream. Realizing the demand in the leather jacket market, our owner set out to provide the motorcycle world with a top-quality product at an honest price. Over the last 8+ years, we have dedicated our time and effort into creating a product that is built to last. Starting out in small shops in NYC, USA Leather Shop. quickly became one of the largest wholesale leather brands in the country. In 2017, We expanded its footprint and launched a retail division which focused heavy on the motorcycle lifestyle. A year later we quickly expanded and released our Customs program. To this day, we remain one of the large manufacturers based in the US and continue to produce products for many of brands including our own.”

UPDATE [August 24, 2026]

Earlier today, First Manufacturing posted this non-response response to my Google Maps review:

We’re genuinely sorry to hear about this experience. We completely understand why receiving unsolicited emails at an address you created specifically for First MFG would be concerning, and we don’t take that concern lightly. While we stand by our privacy practices, we understand that simply telling you this happened elsewhere doesn’t address how frustrating and suspicious the situation feels from your perspective. We appreciate you bringing this to our attention and will make sure your concerns are shared with the appropriate team for further review. Thank you as well for your kind words about the quality of your jacket. If you need any further assistance, please reach out to us at orders@firstmfg.com, and we’ll be happy to help.