Sent a Confidential Document to the Wrong Person?

If you sent a confidential document to the wrong person, act promptly: stop further delivery where possible, restrict any hosted access, preserve the facts, and notify the person responsible for incident response. Do not assume email recall worked or that a deleted link retrieves an attachment already received.

Your next steps depend on the delivery method and the information involved. A restricted link sent to an unauthorized address is different from a downloaded spreadsheet attached to an email. This guide helps you describe that difference, contain what remains under your control, and make a proportionate response decision.

First, establish exactly what was sent

Take a breath and identify the actual message or sharing event. Was it one attachment, several files, a folder link, or a link to a wider collection? Check the recipient address rather than relying on the display name. A contact with a similar name can be the source of the mistake, but you still need the complete address for the record.

Identify the document version. Sending a draft that contains hidden notes may have a different impact from sending the approved public brochure with the same visible title. Do not edit the source immediately and then lose track of which version was delivered.

Record when the event occurred and when you noticed it. Use the system’s displayed time and timezone where available. Preserve the message reference and relevant sharing settings through your approved process. Avoid creating unnecessary screenshots of confidential pages.

If the delivery includes access to a room or folder, inspect its scope. A link that appears to point to one file may provide a navigation path to additional material. Include that possibility in the initial assessment instead of reporting only the document named in the email.

Contain the access you still control

For hosted material, remove the unintended recipient or disable the relevant sharing route where your permissions allow it. If the wrong address could access a broader folder, review that permission too. Containment should address the actual path, not simply hide the listing card or rename the file.

For a document already shared through SendNow, revoking its link can restrict further hosted access, although it cannot retrieve copies already saved.

Keep legitimate users informed through the appropriate internal owner if the change interrupts their work. Do not leave unsafe access in place just to avoid inconvenience, but do not silently create a second uncontrolled link as a replacement either.

For an attachment, you can ask the recipient not to use or forward it and to follow an agreed deletion request. That request may reduce exposure, but it does not establish that no copies exist. Email recall features have conditions and should not be treated as universal retrieval controls.

Stop further automated sends if the same mistake could recur. For example, a saved contact, template, recipient group, or integration may repeat the incorrect delivery. Check the immediate workflow without erasing logs needed to understand the first event.

Do not delete the evidence because you are embarrassed. Containing access and preserving a reliable record can happen together. The incident owner can determine how long the original message and related logs should be retained.

Notify the right internal owner

Tell the organization’s designated security, privacy, or incident contact promptly. If you do not know who that is, inform your manager and ask them to route the case. Provide the facts you have, clearly separating confirmed events from possibilities.

A useful initial note includes the recipient, files or access scope, sending time, discovery time, information sensitivity, containment already attempted, and any known recipient response. Say “unknown” when you cannot establish whether the file was opened or copied. Do not replace uncertainty with a guess that feels reassuring.

Avoid broadcasting the incident to people who do not need the contents. The response team can coordinate communications with clients, affected individuals, vendors, or regulators where required. Individual staff should not make legal promises or announce that notification is unnecessary before the assessment is complete.

NIST’s current incident-response publication connects preparation and response with broader risk management. NIST SP 800-61 Revision 3 For this workflow, the practical lesson is to have a named owner and a repeatable decision process rather than relying on whoever sent the message to manage everything alone.

The existence of a deadline or reporting obligation depends on applicable law, contract, and circumstances. This article does not provide a universal legal timetable. Give the responsible reviewer the facts early enough to assess obligations without unnecessary delay.

Assess exposure rather than only the sending mistake

The fact that the wrong address was entered starts the assessment; it does not finish it. Identify what the document reveals and whether the recipient had any legitimate relationship with the information. A trusted colleague receiving data outside their role still represents a handling issue, even if the probability of deliberate misuse is different.

Check access records where available, but read their limitations. No recorded view may reflect an authentication block, incomplete logging, a technical issue, or a delivery route outside the platform. A recorded view does not by itself prove that the person read every page or retained no copy.

Ask whether credentials, payment instructions, identifiers, or sensitive personal records were exposed. The response may require actions beyond document access, such as credential rotation or a finance review. Those decisions belong with the relevant owners, not a generic instruction to change everything.

A fictional case: the wrong adviser receives a forecast

A fictional founder sends a financial forecast to the wrong adviser because two contacts share the same first name. The email contains an attachment and a link to a working collection. The founder notices the mistake shortly afterward.

The founder records the message and identifies the exact forecast version. They remove the unintended address from the hosted collection and report the event to the company’s designated incident owner. The owner checks whether the link was restricted to named recipients and asks for the available access record.

The attachment cannot be treated as retrieved. The founder sends a brief, approved message asking the recipient not to use or distribute it and to confirm the agreed deletion action. The recipient cooperates, but the incident record distinguishes that confirmation from independent proof that all copies are gone.

The assessment finds that the collection permission blocked the wrong address, while the attachment exposed a limited set of business forecasts. The owner reviews applicable agreements and decides the communications and follow-up. The contact record is corrected, and future sends of sensitive forecasts require a recipient check before release.

This is an invented example, not a claim about a real incident or a guaranteed outcome. Its value is the separation of facts: the hosted route was contained, the attachment remained a received copy, and the response decision used the actual information scope rather than the sender’s initial hope.

Communicate without creating another disclosure

The recipient message should be calm and specific. Identify the mistaken delivery sufficiently for them to find it, ask them not to use or forward it, and provide the approved next action. Do not attach a second copy or describe additional sensitive details just to explain why the first copy mattered.

Use your incident owner’s instructions before contacting clients or affected individuals. Consistent communications help avoid contradictory promises. If the recipient disputes receipt or refuses to cooperate, record that fact and escalate rather than starting an argument through email.

Keep the original business task separate from the incident. Sending the correct recipient a new copy may still be necessary, but verify that delivery independently. Do not use the incident response thread as the distribution list for the revised document.

If you learn new facts, update the case. A later recipient confirmation, access event, or discovery of another attachment can change the assessment. Record when the information became known instead of rewriting the original note as though you knew everything from the start.

Prevent the same mistake next time

Choose prevention that addresses the cause. If autocomplete selected the wrong address, require a full-address check for sensitive sends. If a recipient group was stale, assign an owner to review it. If a template contained an old contact, correct the template and check where it is reused.

Consider reducing the material included in routine deliveries. A focused extract or restricted route can limit the impact of a future addressing error, although it cannot remove all risk. Make the safer workflow convenient enough that staff will actually use it under pressure.

Close the case only when the response owner has recorded the outcome, residual uncertainty, and follow-up actions. “Recipient said sorry” or “link disabled” may be useful facts, but neither substitutes for an assessment of what happened.

Frequently asked questions

Should I wait to see whether the recipient opens it?+

No. Contain what you can and report promptly. Waiting can increase exposure and reduce the time available for assessment.

Does deleting a hosted document remove an email attachment?+

No. An attachment already delivered is a separate copy. Hosted access controls do not retrieve that copy.

Must every mistake be reported to a regulator?+

That depends on applicable rules and circumstances. The responsible privacy or legal reviewer should assess obligations using the incident facts.

Before you proceed

Report the mistake honestly, contain the controllable access, and keep confirmed facts separate from hopes. That gives the response owner a stronger basis for protecting the information and deciding what happens next.

Explore related workflows

• What to Do When a Private Document Link Goes Public

• Investigate Unexpected Document Downloads

• Protect Confidential Files After a Laptop Is Stolen

Related articles

• What to Do When a Private Document Link Goes Public

• Investigate Unexpected Document Downloads

• Protect Confidential Files After a Laptop Is Stolen

• How to Revoke Shared File Access

Sources and editorial disclosure

Primary documentation reviewed October 13, 2026. Worked examples are fictional illustrations. Checklists and decision frameworks are editorial recommendations; product-specific facts are linked to official documentation. These guides do not claim that signed-in product tests or customer projects were performed.

• NIST SP 800-61 Revision 3

VDR Directory is published by the team behind SendNow. This ownership is relevant when evaluating any product mention. Stock photos illustrate general context; they do not demonstrate software features or identify actual affected people. Controls and tool availability depend on the provider, edition, version, device and configuration. No guide guarantees confidentiality, regulatory compliance, acceptance of altered documents, or search rankings.