External PII Exposure Fuels Social Engineering, Data Breaches

Executive Takeaways

• External employee PII is an effective, easy-to-access attack vector.
• Threat actors often combine exposed employee PII with social engineering tactics to attack organizations.
• Data Brokers and People Search Sites are major sources of exposed employee PII.
• External Data Privacy (EDP) solutions provide an extra layer of defense against these attacks by scanning, removing, and monitoring exposed employee PII.

Employee PII: An Easy-to-access, Effective Attack Vector

External employee Personally Identifiable Information (PII) is a highly effective attack vector easily accessible to attackers. This PII is often used with social engineering tactics to facilitate attacks and data breaches. The result is a payload that is highly personalized, hard to detect, and potentially devastating.

Social engineering is a manipulation tactic that plays on human emotions. Attackers use it to trick employees into feeling a sense of familiarity and trust.

For example, attackers sometimes use PII to craft a message that appears to come from the employee’s boss. In doing so, the attacker uses social engineering to formulate a spear phishing email.

PII exposure, social engineering, and data breaches are all interrelated. Let us clarify this relationship before proceeding further.

Exposed PII enables most social engineering attacks, and many social engineering attacks lead to data breaches. 

In other words, many of the security ills that ail organizations are traceable back to PII exposure and social engineering. 

An EDP solution can scan for, monitor, and remove exposed employee PII from vulnerable sites, like Data Brokers and People Search Sites, which have accumulated and leaked mass stores of PII [1].

How External PII Fuels Social Engineering

The vast amount of exposed PII is staggering. In 2021, experts estimate that 3 billion records were exposed in data breaches worldwide [2]. (As a comparison, there are 8 billion people on Earth.)

The vast stores of external employee PII are a precious resource for attackers allowing them to create highly personalized messages that bypass security controls.

Social engineering attacks generally involve following a series of repeatable steps.

First, the attacker accesses employee PII through open-source information or databases of Data Brokers and People Search Sites. Then, they use this PII to create spear phishing emails that appear to come from a trusted source. Understanding common elements of social engineering can mitigate the risk of a data breach.

Organizations can implement an EDP solution to mitigate the risks of social engineering attacks and data breaches. Implementing EDP solutions provides an extra layer of defense against social engineering attacks and data breaches.

Other Social Engineering Methods 

While our focus here is primarily on spear phishing, as it is the most common social engineering attack, it is helpful to briefly discuss other prevalent attacks that may lead to data breaches.

Business Email Compromise (BEC)

Business email compromise (BEC) is a spear phishing attack that relies heavily on social engineering. It is a rapidly expanding attack vector that can be highly costly to organizations. An FBI Public Service Announcement released in May 2022 states that BEC has resulted in a staggering $43 billion in losses [2].

BEC attackers often start by trying to establish a conversation with the victim to build rapport. Over time, the conversation shifts towards a transactional context, and the attacker eventually requests a money transfer. The goal is to acquire funds from the organization without being detected. These attacks have become increasingly sophisticated and advanced due to the abundance of publicly available PII.

Pretexting

Pretexting is a social engineering attack involving an attacker creating a false scenario to manipulate their victims into revealing confidential information.

The attack commonly involves an attacker posing as a trusted entity and using deception to obtain privileged information, such as using the pretext of being from an IT department to gain access to sensitive data.

Attacker Steps to Social Engineering, Data Breaches

As mentioned earlier, attackers use employee PII to create convincing social engineering emails that can circumvent technical controls. However, attackers don’t stop there. They follow several additional steps to execute a social engineering attack and a data breach in succession.

It’s important to note that social engineering is increasingly being used to facilitate data breaches. And nearly every data breach involves some element of social engineering.

This is a significant concern, given that the average data breach cost in the United States is around $9.5 million, the highest of any country [3]. With the growing use of cloud services and mobile devices, social engineering-initiated data breaches are expected to become even more prevalent.

Therefore, employees and organizations must be aware of the risks of social engineering attacks and take steps to protect themselves and minimize the impact of data breaches.

Social Engineering to a Data Breach Attack

Here are the steps that attackers take to execute a social engineering attack and a data breach:

1. Reconnaissance: The attacker gathers intelligence about the target organization by researching online and offline sources of information. The goal is to identify potential targets and weaknesses in the organization’s security posture.
2. Crafting the message: Once the attacker has gathered enough information, they can craft a tailored message that appears to come from a trusted source, such as a company executive or IT department. The message may include an urgent call to action, such as updating login credentials or downloading a file.
3. Delivery: The attacker sends the message to the target employees, using techniques such as email spoofing or domain impersonation to make it look legitimate. They may also utilize multiple communication channels, such as email and phone, to increase their chances of success.
4. Compromise: If the target falls for the social engineering attack, the attacker can access their credentials, install malware, or otherwise compromise their system. From there, they can use that foothold to escalate their attack and breach the organization’s systems and data.

By understanding these successively damaging steps, employees and organizations can take steps to protect themselves from social engineering attacks and minimize the risk of data breaches.

EDP Fills a Critical Security Gap

Implementing an External Data Privacy (EDP) solution is crucial for combating PII exposure. EDP solutions address a critical gap in traditional cybersecurity solutions by monitoring and removing exposed PII from sites susceptible to hacking and social engineering, such as Data Brokers and People Search Sites.

Although it’s crucial to secure technical infrastructure, many modern cybersecurity solutions neglect the importance of protecting the data and information contained within that infrastructure.

Privacy Bee Business is an EDP provider that offers vital external employee PII removal from over 350 Data Brokers and People Search Sites, filling this gap. In addition to this service, Privacy Bee offers other critical services that provide a comprehensive Data Breach defense, such as 24/7 real-time monitoring of privacy risks and a Privacy Risk Score for each employee and department.

By removing employee PII from public databases, Privacy Bee can help mitigate the risk of social engineering attacks and breaches that rely on access to this information.

Start de-risking your organization now with a free External Data Privacy Audit.

Citations

[1] Risk Based Security. (2022). 2021 Year End Data Breach QuickView Report. https://www.riskbasedsecurity.com/wp-content/uploads/2022/02/2021-Year-End-Data-Breach-QuickView-Report.pdf

[2] FBI. (2022, May 10). Business Email Compromise (BEC) Statistics, Public Service Announcement. https://www.ic3.gov/Media/Y2022/PSA220504%5C

[3] IBM Security & Ponemon Institute. (2022). Cost of a Data Breach Report 2022. IBM Security. https://www.ibm.com/security/data-breach