Corrlinks Leaks Explained: Everything You Need to Know About Inmate Email Privacy
By James H. Sterling
Correctional technology vendors maintain vast repositories of sensitive records, yet their defensive measures historically trail commercial standards. While CorrLinks has managed to avoid a confirmed monolithic database exfiltration, the broader ecosystem of prison technology vendors has faced severe security failures over the past decade.
| Vendor & System | Year Range | Scope of Compromise | Underlying Cause |
|---|---|---|---|
| Securus Technologies | 2015, 2018 | Over 70 million call records and attorney-client recordings leaked | Server misconfiguration and an anonymous insider leak provided to The Intercept |
| Telmate (GettingOut) | 2020, 2021 | Millions of personal logs, inmate locations, and family chat logs exposed | Unprotected database left accessible on the public internet without password protection |
| CorrLinks / ATG (Public Rumor) | 2024, 2026 | Localized message disclosures; high-profile detainee emails published online | Credential stuffing against outside accounts combined with court records and FOIA releases |
The distinction between an infrastructure hack and an account-level compromise matters. When Securus left millions of attorney-client calls open to download, it represented a catastrophic infrastructural failure. The recent CorrLinks incidents, by contrast, expose how weak user-side authentication and public record requests intersect to lay private communications bare.
James Sterling reports on renewable energy developments, climate policy, ecological conservation, and green tech innovations around the globe.
