Business Email Compromise emails sent to personal email accounts

Question

I am using Google workspace to handle my domain emails. At a certain point, employees started to receive spoofing emails to their @mydomain.com addresses. I blocked these emails and it worked.

However, after I blocked it, employees started to receive spoofing emails to their personal accounts from spammers who pretend to be the CEO of the company.

How did the attackers reach them on employee personal accounts? Is it a manual or systematic process?

I know I have no control over employees' personal emails. However, is there a way to block the sender on their accounts? Employees use free email providers not only one address.

Here is an example of received emails:

Answer 1

If one of your business accounts were compromised and that account had access to personal email addresses, like in their contacts, then the attackers could have harvested those email addresses. But there are no details in your question to make a determination about what happened or how the personal email addresses were discovered.

No, you can't block senders to 3rd party email accounts, which is what your employee personal email accounts are. If you could, then you would have the power to block people from sending emails to me, for instance.

Always report spam and phishing emails to your email provider.

Answer 2

Using OSINT it is possible to find the personal email address of someone.

Usually it is a mix of manual and automated process.

This can be done for example by using a tool such as RocketReach.