Who can read our customers email and try to hack our mailserver

Question

To ease tracking replies and bounces, we send automated emails such as - order confirmations, password recovery, etc with a unique sender address typically like this FROM sup-[custno]-[invno]-[hash]@sup.ourdom.tld

Now I see failed login attempts to our IMAP-server, with these addresses. Each address is tried 6 times, from IP-addresses all over the world, China, Taiwan, Africa, South America, so it is obviously a botnet.

These addresses only exist in transit and on the recipients device, how could they be picked up by hackers? Do we inform the specific customers that somebody is reading their email?

Are we even allowed to send unsolicited emails to these customers, or can that be considered mails concerning transactions we have had with them previously?

Answer 1

If the customer system is infected or email account is compromised then the attacker can easily get your details.

To answer your second point, I wont suggest to inform your customers about security breach. People wont trust on this part, and may lead to confusion and panic. Instead you can send email to make it look like routine security exercise in which you want people to change there password to have the communications secure.

Block those IP address at network level blacklist or hardware firewall level. One more way is to get new email address for sending.

Answer 2

Attacks where email address books are stolen are fairly common. However, I have only seen this data used for spearphishing attacks, and IMAP login attempts are rather unusual.

I do not think you are not obligated to do anything about the situation. It perhaps would be nice to alert your customers, but by no means necessary. I do not know how this relates to any laws, regulations, or unwritten rules.

If you do choose to notify, to try and avoid backfire, as mentioned in the comments, you should make it clear that you are trying to be helpful, and avoid anything technical unless someone asks for it. You could say that parts of emails you specifically sent to them are being used by malicious parties to attack your company, and that they may want to consider evaluating the security of their email accounts and data.