I filed my taxes through TaxAct and last night I received an email from their reviewer (a very generic "we need more time to look at this" email) - After I received this, I started receiving emails from other personal Gmail accounts to TaxAct with my email CC'd - one of them actually greeted me directly, as though I were the TaxAct representative. I'm not sure how this happened, because when I look at the original message it appears to be addressed only to me. The only thing I can even think of is that perhaps these other people were BCC'd on the email addressed to me? Because they for sure have my email copied in their replies. This seems like a huge breach of data privacy as I now have full names and email addresses of their clients, and they have mine. I tried calling their customer support this morning and the rep I spoke with didn't seem to understand why I was upset - and when I asked to speak to a supervisor I kind of got placated and passed around with a "they'll call you". I'm not sure if this truly breaches any kind of data privacy law or how I even begin to handle it. Location: California