The Global Address List (GAL) is an organization-wide directory used by mail systems to publish shared contact information, such as names, email addresses, job titles, and sometimes departments or phone numbers. In large environments, it helps users find coworkers and resolve internal recipients without knowing every address.
In cyber security, the GAL matters because it maps the organization’s people and structure. Attackers who steal it can identify high-value targets, build convincing spear-phishing messages, and learn naming patterns for internal accounts and groups. In mailbox or webmail compromises, GAL data is often collected alongside message content because it is easy to export once an authenticated session is abused. Defenders should treat directory access as sensitive, monitor unusual enumeration or export activity, and limit what directory fields are exposed to users who do not need them.