Executive Home Addresses Are Becoming an Enterprise Attack Surface

Personal information about senior leaders is becoming part of the enterprise attack surface, according to new research from Incogni and Ironwall that examined executives in finance, healthcare and energy.

Researchers analyzed 2,401 publicly traded companies and 618 executives and board members. Automated checks found that 32.5 percent of the leaders were likely discoverable on people-search sites. In a separate manual test, privacy specialists found the home addresses of eight out of 10 financial-sector CEOs within 10 minutes per person. The manual sample covered only 60 people, so the role and sector comparisons are directional rather than definitive.

The risk extends beyond physical safety. A home address, relative's name or other personal detail can strengthen a spear-phishing or vishing pretext. Internal documents exposed in corporate breaches add vendor names, reporting lines and current projects, giving attackers more material for business-email-compromise attempts.

Security programs rarely control the data broker and public-record ecosystem directly, but they can reduce the operational impact. Executive protection should include exposure monitoring, removal requests, hardened account-recovery procedures and extra verification for payments or access requests that invoke personal details.