One Action, Endless Risks

How One Social Media Post Can Unravel Your Security

During one of my routine sweeps of social media for new and emerging threats this morning, I came across a post by a lady. She had uploaded a picture of herself with some colleagues, holding a certificate of internal appreciation she had received at her workplace.

The certificate had the company's name emblazoned across it. She had also tagged the building where her office is located, as well as the colleagues in the picture with her. And hers is an open account.

Effectively, she had given away the name of her workplace, her work address, and the accounts of her colleagues.

Off the top of my head, I can think of a smart cybercriminal using ChatGPT to conduct quick research on her company, which takes about 60 seconds. Then, they could craft phishing emails using any number of malicious AI models available on the dark web at 500 bucks a pop. They could easily get her company's and possibly her colleagues' email addresses using LinkedIn and the company website, and then launch a patient, targeted phishing campaign, with a ransomware attack as the ultimate payoff.

And this isn't just about the digital space. A stalker could simply lie in wait outside her office and follow her home. A jilted lover could turn up at her workplace. Someone could send malicious or defamatory emails about her to her employers.

Personal cybersecurity, and by extension physical security, is rarely compromised by just one action. More often, it's the result of a combination of negligent behaviours that, when pieced together, create a complete picture for someone with ill intent. If you are not a content creator, have a private account. If you have an open account, be careful what you post and who you tag. If you need to have a public account for any reason, make a second private account.

It takes one bit of information for a threat actor to latch onto. And once it starts, the possibilities are endless.