I'm Alec. I founded Gmail Unsubscribe, and people email us about this most weeks. Their inbox went from normal to a few hundred new messages, and they want to know whether they did something wrong.
Usually they didn't. A sudden influx of emails nearly always traces back to one of three causes, and they need different fixes. One of them is an attack, so check for it before you start deleting.
First, look at what is actually arriving
Open Gmail and sort out what the new mail is before doing anything to it. Two searches do most of the work:
newer_than:1dshows everything from the last 24 hours. Scroll it and note the senders.newer_than:1d subject:(confirm OR verify OR welcome)shows signup confirmations from the same window.
Then match what you see to this table.
| What you see | Likely cause | What to do first |
|---|---|---|
| Hundreds of "confirm your subscription" and "welcome" emails from sites you never visited, mostly within an hour or two | Email bomb | Check your accounts for fraud, then clear the flood |
| Obvious junk: fake invoices, prize offers, crypto pitches, senders with random names | Your address leaked or was sold | Report as spam, check for breaches |
| Real newsletters and store promotions from brands you recognize, just a lot of them | Signups piling up | Unsubscribe from the ones you don't read |
Most floods are a mix, but one row usually dominates.
Cause 1: an email bomb hiding something
This is the one to rule out first. In an email bomb, also called subscription bombing, someone runs a script that signs your address up to hundreds of newsletters, forums and store accounts at once. Every one of those sites sends a welcome or confirmation email, and your inbox fills in minutes. Proofpoint, an email security company, reported in December 2025 that these attacks can deliver over 1,500 emails an hour.
The flood is rarely the goal. Proofpoint describes it as cover for an account takeover, such as a password reset email that the victim never sees because it is buried under a thousand newsletters. BlackCloak, a fraud-protection firm, documented the same trick against shoppers: attackers placed orders from hacked Walmart.com accounts, then flooded the victims with registration emails so the purchase confirmation was pushed out of sight.
If the table pointed you here, do these before you delete anything:
- Search for the message they want buried. Try
newer_than:3d (password OR reset OR "sign-in" OR order OR receipt OR purchase). Look for a reset you didn't request, a new-device sign-in, or an order you didn't place. - Check your money directly. Log in to your bank, card and big shopping accounts (Amazon, PayPal and the like) by typing the address into your browser. Don't use links from the flood. Look for charges and address changes from the last few days.
- Run Google's Security Checkup at
myaccount.google.com/security-checkup. It lists recent security events and signed-in devices for your Google Account. Remove anything you don't recognize and change your password if anything looks wrong. - Change the password on any account that shows activity you didn't make, and turn on 2-step verification there if it's off.
Once you're satisfied nothing is hidden, clear the flood. Search subject:(confirm OR verify OR welcome) newer_than:3d, select all, and delete. Mass deleting in Gmail covers selecting past the first page of results.
Don't click confirm on any of them. Most sites that send a confirmation email won't add you to the list until you click it, so leaving them alone keeps you off. The few that added you without asking will show up again over the next week or two, and those are the only ones worth unsubscribing from.
Cause 2: your address leaked, or someone sold it
If the new mail is obvious junk rather than confirmations, your address has probably landed on a spam list. Addresses end up there after a data breach, or scraped from a public page, or sold by a site you signed up to years ago.
Enter your address at haveibeenpwned.com. It's a free, independent service that lists the known breaches containing an address. A breach in the last few months lines up well with a sudden jump in spam. Change the password on the breached site, and on anywhere else you used the same one.
Then handle the junk as spam, not as subscriptions. Select it and click Report spam, which also teaches Gmail's filter what the new wave looks like. Don't click unsubscribe links in mail from senders you never signed up with, because a click tells the sender your address is live. How to stop spam emails in Gmail covers the difference between the two piles in full, and how to block unwanted emails covers filters for the senders who keep changing their name.
Cause 3: signups you actually made, all mailing at once
The least dramatic cause is the most common one. You bought a few things online, tried two apps, joined a loyalty program, and every one of them now sends email. Holidays and big sale weeks make it feel sudden, because every brand you've bought from sends more mail in the same few weeks.
When we scan a new user's Gmail, the first scan finds about 15 subscription senders on average. Most people guess fewer. You can clear these in one sitting, because they're legitimate senders that honor unsubscribe requests. Gmail's Manage subscriptions view lists some of them, and mass unsubscribing covers doing a few dozen at once.
Our extension scans your Gmail and lists every subscription sender with how much each one sends, so you can unsubscribe from the ones you don't read in bulk. It uses each sender's official opt-out and tells you when a sender has no working one. Free covers unlimited scans and archiving plus 5 unsubscribes a month. Pro is $35.88 a year for unlimited.
Add to Chrome, freeA caveat for email bombs: our extension won't help much while one is in progress. The flood is mostly confirmation emails from lists you haven't joined, and the fix for those is to delete them and not confirm. It becomes useful a week or two later, for the handful of senders that signed you up anyway.
Keeping the next flood smaller
You can't stop someone typing your address into a signup form, but you can make the next wave easier to sort. Use yourname+store@gmail.com style aliases when you sign up for things. Gmail delivers them to your normal inbox, and a filter on the alias clears everything sent to it if one gets leaked. Unsubscribe from lists you stopped reading when you notice them, rather than letting 15 senders build up to 40. And keep 2-step verification on your Google Account and your bank, so a buried password reset can't lock you out on its own.
Common questions
Why am I suddenly getting so many emails?
Usually a leaked or sold address, a pile-up of your own signups, or an email bomb. The table at the top of this page tells them apart in a couple of minutes. Rule out the email bomb first, because it is the one that hides fraud.
What is an email bomb?
Someone signs your address up to hundreds of mailing lists and sites at once with a script, so your inbox floods with welcome and confirmation emails. Proofpoint reports these attacks can deliver over 1,500 emails an hour, often to bury a password reset or a purchase receipt.
Should I unsubscribe from everything in an email bomb?
Not first. Check your accounts for fraud, then delete the confirmation emails without clicking confirm. Unsubscribe only from senders that keep mailing a week or two later.
How do I find out if my address was in a data breach?
Enter it at haveibeenpwned.com. It's free and lists the known breaches that include your address.
Will Gmail stop the flood on its own?
Partly. Gmail catches a lot of true spam, but confirmation emails from real sites often look legitimate and land in the inbox. Report a few as spam, and use a search or filter on the common subject words to clear the rest.