A Global Address List is an organization’s internal directory of users, mailboxes, groups, and contacts. In email systems such as Exchange or Zimbra-like deployments, it helps users look up addresses, display names, departments, and other identity details from one central source.
GAL data matters in cyber security because it reveals the structure of the organization: who exists, how people are connected, and which mail-enabled accounts or groups may be valuable targets. Attackers who gain access to the GAL can improve phishing, impersonation, and lateral reconnaissance by mapping real names to accounts and roles. In email compromise cases, directory access can also support follow-on abuse such as targeted password-reset attacks or identifying high-value departments. Defenders treat GAL exposure as sensitive because it often turns a simple mailbox compromise into broader identity intelligence. Protecting it means limiting access, monitoring unusual directory queries, and ensuring vulnerable webmail or SSO components cannot be used to read directory data from a logged-in session.