When sending a mass mail to a list of recipients using a normal mail client you don't want to include all the recipients in the To: or Cc: fields, both because it leaks the addresses of all the recipients and because of the risk of reply allpocalypse. That's when a recipient does a reply-all in response to the mail, typically asking to be removed, to all the recpients, and people respond to that and millions of emails later everyone's mailbox is unusable.
Anti-fraud nonprofit Cifas was left red-faced after sending out a calendar invite that exposed the email addresses of dozens of individuals working across the fraud space. The invite was sent in August to a session scheduled for October 16 about the organization's JustMe app, which allows individuals to confirm if applications made in their name are genuine. Over a dozen addresses were exposed in the To field, with another 45 in the CC field, according to the message.