Lost a decade and a half of correspondence dating back to my teenage years. I had imported my phone number I'd had since I was 16 into voice, and it doubled as my Signal number. I even had a Gsuite subscription so I could use their (admittedly decently) UI to power my firstname @ lastname dot com email address.

I will never use their services again, I was really digusted by this failure.

i could gave moved my google voice number, but it seems like a convoluted process and have had my number since about Grand Central acquisition.

In my case, many years ago I changed my last name. (Turns out a lot of women also do this when they do things like... get married. But also for a progressive company everyone's purchases being permanently locked to their deadname seems... bad.) But all of my Android apps, my entire digital life at the time, was permanently locked to my old name. I had another account I created as a mail forwarder but if people sent an invite to it for a Google thing it wouldn't connect to my real account, and obviously there was an added security risk of someone stealing my forwarding account.

I remember talking to Yonatan Zunger about this problem during the Google+ era and it seemed to be renaming an account wasn't something the company was capable of.

I’ve received some sensitive/PII content over the years.

I’ve wondered if this person has access to any of my information?

Not necessarily related to this post, but wonder why and how this could happen.

you could be first_last@yahoo.com but also have rando_waldo@yahoo.com or ymail.com receive emails in same mailbox. And you could choose the "From" address form a drop-down when sending outbound emails or replies.

For an organisation that often does deeply intelligent things, they spend such a lot of time treating their users unnecessarily poorly because obvious implications seem not to occur to them.

Although I primarily use a Gmail for my personal email, I still have a Hotmail address from the 90s.

For at least 10 years now Outlook.com and Microsoft accounts have supported multiple aliases.

This has allowed me to keep my old cringey box name at Hotmail address, but also have a name.surname@outlook.com on the same account, which looks nicer for Microsoft services I use, like Windows login with OneDrive.

Wonder if this will be used for that at some point

So I can have email aliases under that domain, and even choose the alias for outgoing email.

However! This creates an extra security hole. Once I was SIM-swapped (when the attacker calls up a phone company and convinces them to redirect sms to their SIM). I had used it as a second factor at GoDaddy and had to act fast. GoDaddy had already allowed the attacker to authenticate with the sms (dumb!) and port the domain name. I realized what was happening only because the attacker sent “test” emails to my email at the domain. Had they not done that, I might have been none the wiser. I called GoDaddy and got them to cancel it, thankfully. Otherwise they’d have reset passwords armed with email AND phone number.

Since then I use the non-SMS SECOND FACTOR on most services, as NIST had been recommending for a decade now.

I personally recommend using a username+alias@gmail.com which gmail and others support, with a different but easy-to-remember alias per site, so social attackers can’t even correctly say your email to the dude on the phone.

Michael Terpin, a guy I know, got $27 million dollars in crypto stolen a decade ago by a SIM Swapper and sued AT&T for it. Not sure if he won… he moved to Puerto Rico to avoid taxes and brought Brock Pierce and other crypto bros with him LOL.