Fake Tealium / mParticle customer data platform subscription payment failed, data collection tags and audience segments suspended, event streams disabled, or customer data platform workflows at risk phishing

Phishing emails impersonating Tealium or mParticle claiming the customer data platform subscription payment has failed, data collection tags are suspended, event streams are disabled, audience segments are no longer active, or customer data platform workflows have been temporarily suspended — directing them to update billing or restore access through a credential-harvesting portal. A distinct attack category targeting enterprise CDPs that sit at the data collection layer of the marketing and analytics stack — suspension simultaneously breaks all customer data collection across every website, mobile app, and digital touchpoint, halting the data flow that feeds every downstream personalization, advertising, and analytics system. Key facts: (1) Tealium serves 1,000+ enterprise customers ($100,000-$1,000,000+/year) including Nokia, Kia, and HSBC as one of the two dominant enterprise CDPs and the pioneer of the Universal Data Layer — Tealium's tag management system (iQ) manages all marketing and analytics tags across enterprise digital properties; a Tealium subscription suspension disables all managed tags simultaneously — Google Analytics stops collecting, Facebook Pixel stops firing, Adobe Analytics stops tracking, and every third-party marketing technology that depends on Tealium tag delivery stops receiving data; the entire martech stack goes blind at once; (2) The 'data collection tags suspended' hook is the highest-urgency vector for enterprise marketing teams: tags that stop firing immediately degrade campaign targeting — Facebook retargeting audiences stop updating (new site visitors are not added, converted customers are not excluded), Google Ads remarketing lists freeze, and A/B testing platforms receive no new user data; every day of tag suspension creates compounding staleness in every advertising audience; (3) mParticle serves 300+ enterprise consumer brands ($50,000-$500,000+/year) including Starbucks, Spotify, and NBC Universal as the leading mobile-first CDP built around event stream processing — mParticle's server-side event streaming architecture means it is the central router for all customer behavioral data; mParticle suspension stops all event forwarding to downstream destinations (Braze, Amplitude, Snowflake, AppsFlyer) simultaneously; a Starbucks-scale company with mParticle as the CDP hub experiences a total data blackout across every connected downstream platform the moment event streams stop; (4) The 'audience segments disabled' hook targets a specific activation workflow: both Tealium and mParticle generate real-time audience segments that activate across advertising and personalization platforms — a high-value customer segment that was actively suppressing in paid social ads (to avoid wasting spend on existing customers) stops being refreshed, causing ad spend waste to resume immediately; (5) Tealium and mParticle credentials expose the complete customer data architecture: the full data layer specification showing every customer attribute and behavioral event being collected, the routing rules showing which customer data flows to which downstream destination, the audience segment definitions revealing the behavioral logic for identifying high-value customers and churn risks, and the activation mappings connecting CDP audiences to advertising platforms and personalization engines. Warning signs: sender not tealium.com or mparticle.com; genuine Tealium billing at my.tealiumiq.com/account/billing; mParticle billing at app.mparticle.com/billing.