Booking vet care online usually needs an email address. It sits on the same client record as the pet name, species, breed, medical history, microchip number and insurance details. One alias per vet or pet service keeps its messages apart. A leak at one service then stays contained to that alias. The alias must stay active for as long as the pet is under care, so appointment and results messages continue to arrive.
What vet booking collects#
Booking software collects more than a contact address. Porter Veterinary Center lists email address and physical address among its contact identifiers, and microchip number, vaccination history and prior medical records among the pet information it holds. Home Vets London lists name, email address and telephone number, plus pet health information including medical records. The owner address and the pet medical record are therefore collected together and stored together.
The minimum for a booking is smaller. Vev says a pet owner booking from a clinic online page has to enter a name and an email address, and can leave phone number and address blank. Reservio says a reservation needs an email address, or a sign-in with Google, Apple or Facebook. Vev follows a booking with three emails: a confirmation, a reminder ahead of the appointment, and a thank-you afterwards. Reservio sends a confirmation email. It carries the booking details and a link to change or cancel the booking. Setmore and Bookafy both describe automatic text or email reminders for every visit.
Where the address travels#
Once given, the address moves beyond the clinic. Vetstoria is the booking platform many clinics use. PetDesk Brand Holdings, which owns Vetstoria, says in its privacy policy that it processes customer data for the clinic, including email addresses, appointment data and pet information such as vaccines, insurance, microchip number and medical history. The same policy says personal data goes to service providers and to marketing and advertising partners.
Village Vets says pet information sits on the client record and counts in law as information about the owner. The group passes information to its practice management system provider, to the suppliers that send email, text and WhatsApp messages, to its online booking provider, to laboratories and referral practices, to microchip database operators, and to the pet insurer when the owner has asked it to handle a claim. Prairie Pet Mobile Vet and Vet in a Van describe the same pattern.
Recorded exposures#
Exposures of vet and pet insurance data, with owner email addresses attached, have already happened. On 10 December 2025, TechCrunch reported that Petco had taken part of its Vetco Clinics website offline after a security lapse exposed customer records to the open web. Records could be downloaded by anyone, with no login, and they included names, home address, email address and phone number, visit summaries, medical histories and prescription records, and pet names, species, breed, age, microchip number and medical vitals. The cause was an insecure direct object reference in the PDF generation page on the petpass.com portal, where customer numbers ran in sequence. Google had indexed at least one record dated mid-2020. Petco did not confirm how many customers were affected, and TechCrunch estimated the total ran into the millions from sequential customer numbers checked at intervals. TechCrunch counted the incident as Petco's third data breach in 2025.
In October 2025, Website Planet reported that researcher Jeremiah Fowler had found a database with no encryption and no password, holding 85,361 files totalling 158 GB. The files included pet insurance claims, veterinary bills and customer communications, with names, physical and email addresses, phone numbers and partial credit card numbers, and pet names, medical histories and microchip numbers. The database appeared to belong to Rainwalk Technology of South Carolina. Fowler sent a responsible disclosure notice and got no reply. Access stayed open for nearly a month. Fowler stated that it is not known whether Rainwalk or a third-party contractor owned the database, or whether anyone else accessed it.
A third exposure, reported in November 2023, involved pet medical records. Website Planet reported that Fowler found a cloud database with no password, holding 56,624 documents totalling 25 GB and apparently belonging to the Worldwide Australian Labradoodle Association. The documents included pet medical reports, DNA tests and pedigree history, and owner names, addresses, phone numbers and email addresses.
A configuration error alone published an address. The Royal College of Veterinary Surgeons stated that between 29 July and 25 August 2026, some alternate phone numbers and individual email addresses appeared on about 789 of over 4,500 practice listings on its Find a Vet service. Of those, 124 appeared to have personal domains such as hotmail.com and gmail.com. The college called it an internal data configuration issue, not a cybersecurity issue.
| Date | Incident | Scale | Source |
|---|---|---|---|
| 10 December 2025 | Vetco Clinics, Petco | Not confirmed by Petco; TechCrunch estimated millions | TechCrunch |
| October 2025 | Rainwalk pet insurance | 85,361 files, 158 GB | Website Planet |
| November 2023 | Worldwide Australian Labradoodle Association | 56,624 documents, 25 GB | Website Planet |
| 29 July to 25 August 2026 | Royal College of Veterinary Surgeons, Find a Vet | About 789 listings; 124 personal-domain addresses | Royal College of Veterinary Surgeons |
Reminders and marketing#
Two kinds of email come from a vet clinic. Messages about an appointment already booked, or about an episode of care the pet is receiving, are service messages under the Village Vets policy. They cover test results, discharge instructions, an invoice or receipt, and a safety recall. The clinic keeps sending them for as long as the person is a client, whatever the marketing preferences say. Health reminders work differently. A reminder that a booster, a worming or flea treatment, a repeat prescription or a dental check is due counts as direct marketing in law, because it invites the owner to book and pay for a service.
Remindlo draws the same line between pre-visit reminders for appointments already booked and reactivation reminders, sent when a booster or health check is due but nothing is in the diary. Village Vets keeps client contact records for 7 years after the last transaction, and clinical records for 7 years from the last treatment. Retention periods differ by country and practice. Those figures describe one practice group, not a universal rule.
Phishing and scam messages#
Pet details make a phishing message more convincing. A sender who knows the pet, the treatment and the amount can look genuine. The Rainwalk report stated that criminals could in theory send fraudulent invoices modelled after real ones, using dates, amounts and claim numbers known only to the care provider, the insurer and the owner. The WALA report described microchip renewal scams, in which owners get emails claiming a pet microchip registration is expiring and urging payment of a fraudulent renewal fee. Microchips do not expire, according to the report.
Even a message that names the pet, the clinic and a real claim number needs checking through the official channel. A leaked record can supply all three details. Links in an unexpected vet or insurer message should not be clicked. An alias helps here. A phishing message sent to the vet alias is visible as a vet message. The alias does not stop phishing on its own, and it does not verify a sender.
One alias per vet or service#
One alias per vet or pet service is the setup. A separate forwarding address goes to each vet clinic, each pet insurer, each microchip registry and each pet pharmacy or pet supply service. The confirmation, the reminder, the lab result and the invoice for that service all arrive on that one alias, and no other service uses it. Spam on the vet alias points to the service it came through. The vet alias belongs on the booking form, on the insurer claim form, and on the microchip registration, and the same alias stays with the same service across visits.
Keeping the alias alive during care#
While the pet is under care, the alias stays alive. Vet records are tied to the pet identity, so appointment messages, lab results, recall reminders and insurance correspondence still need to arrive. Closing the alias after the first visit can block a lab result, a recall reminder for a booster, or a claim decision. A change of vet is a planned move. The new vet gets a new alias, the old vet is told the pet has moved, and the old alias stays active until the old clinic confirms that no record, result or invoice is outstanding.
Microchip registration and insurance claims#
The microchip registry is a separate place where the owner address is stored. The British Small Animal Veterinary Association states that once a microchip has been implanted, the details must be recorded on a Defra approved database. Welsh and Scottish legislation also require the keeper email address where the keeper has one. The owner should check which database holds the pet record. The vet clinic and the microchip database can hold different addresses. Pet Database states that it collects contact details including address, telephone number and email address, and shares data with pet insurance partners and with regulators and public bodies. The Rainwalk claim file contained the claim number, the account holder name, the pet name, the monetary amount, and the veterinary bill.
Pet insurance is a large market. The North American Pet Health Insurance Association estimated 7.03 million pets were insured in North America at the end of 2024, up 12.2 percent from 6.25 million in 2023, with nearly 5.2 billion US dollars in gross written premiums. That figure comes from the Rainwalk report, which cites the association, and was not read directly from the association itself.
What an alias does not cover#
An alias does not make the vet clinic secure, and it does not stop a clinic or a platform from being breached. A portal flaw exposed the full record, medical history and owner address included, whatever address the owner gave. An alias does not hide the pet name, the treatment or the cost from the clinic. The clinic needs those details to provide care. An alias does not stop the clinic from sharing the address with the suppliers who need it. It does not verify a sender. Have I Been Pwned lets the owner check whether an email address appears in a known data breach.
AliasFleet for vet bookings#
AliasFleet provides email aliases that forward mail to a verified destination inbox. A separate alias goes to each vet clinic, insurer, microchip registry or pet service, and each alias forwards to the same destination inbox. The owner can pause or close an alias when a service no longer needs it. The free tier includes 10 active aliases, 1 verified destination inbox, 3 managed subdomains and 100 MB monthly forwarding, according to AliasFleet pricing. AliasFleet does not make the vet clinic secure, and it does not verify the sender of a message.
