The corporate attack surface now extends to the front door

Perceived threats to executives and senior leaders have been rising noticeably over the last few years. Allied Universal’s World Security Report found that concern about violence toward executives increased by an average of 46% across US organizations compared with two years earlier.¹ 

An organization can secure devices, enforce MFA, or rotate credentials, but the December 2024 killing of UnitedHealthcare CEO Brian Thompson showed how little that protects an executive whose movements can still be traced. Thompson’s killer spent more than a week surveilling his movements in New York² and, as he later admitted in court, used a fabricated pretext to obtain the location of a private company event Thompson was scheduled to attend.³ An organization can patch a server, but most have less control over what a convincing enough lie can extract from their own front desks.

This report, produced jointly by Ironwall and Incogni, examines how exposed that information actually is. Our research team analyzed public breach disclosures and executive discoverability on people search sites (PSS) across the finance, healthcare, and energy sectors. Then our privacy specialists went a layer deeper, manually attempting to locate the home addresses of CEOs and CISOs at major companies in each sector. The result: in financial services, these specialists found a sitting CEO’s home address in under 10 minutes, 8 times out of 10.

Together, these findings point to a security perimeter that now extends well past the office door, and a class of risk that most organizations aren’t yet equipped to measure, let alone manage.

Key insights:

• Finance faces a double exposure problem. Financial companies recorded the highest share of reported breaches in the analysis, at 19%, while financial-sector executives also had the highest exposure on people search sites, at 39.1%.
• Corporate security risks can extend all the way to executives’ homes. In a separate, manual search, privacy specialists found the home addresses of 8 out of 10 financial-sector CEOs within just 10 minutes per person.
• Employees are increasingly appearing in breach disclosures. Of 70 identified breaches involving employee data, 34 occurred from 2024 onward. Meaning that workforce data is becoming an increasingly visible part of corporate breach exposure.
• Internal communications are becoming a major source of exposed proprietary information. Breaches involving internal documents and emails rose sharply after 2022 and substantially outnumbered incidents involving source code, intellectual property, or infrastructure keys. 
• Executive exposure differs significantly by role and industry. CEOs were more discoverable than CISOs in finance and healthcare in the manual search, while energy showed the opposite pattern, with 60% of examined CISOs discoverable compared with 50% of CEOs.

The overlooked layer of corporate security

Financial companies stand out across both corporate and personal exposure metrics.

Among the publicly traded companies assessed, 19% of financial firms had a reported breach. In the same sector, 39.1% of executives and board members were likely discoverable on people search sites. A separate, manual investigation located the home addresses of 8 out of 10 financial CEOs within 10 minutes of searching per person.

This overlap matters. Corporate and personal exposure do not necessarily exist independently. Information about an executive’s identity, residence, family, or location can support targeted social engineering, impersonation, harassment or doxxing, or unwanted physical contact.

What changes when someone knows where to look?

Our privacy specialists conducted a separate manual investigation into how easily the home addresses of selected CEOs and CISOs could be found online.

Across 10 companies in each of the 3 sectors, specialists spent 10 minutes searching for each individual.

The results varied by role and sector. In financial services, privacy specialists located the home addresses of 8 out of 10 CEOs, compared with 5 out of 10 in both healthcare and energy. CISOs were generally less exposed in finance and healthcare, where 4 out of 10 addresses were found in each sector. Energy was the exception: specialists located 6 out of 10 energy CISOs, making them the most discoverable CISO group in the investigation.

An experienced researcher could likely locate an executive’s home address given enough time. The more consequential finding is speed: our specialists needed only minutes. Together, the two methodologies capture different layers of exposure: basic discoverability on people search sites, and the deeper exposure that emerges when someone with expertise actively looks.

That speed matters beyond the risk of a physical encounter. A home address or a family member’s name is also usable material for an attacker who never intends to show up in person. Vishing (voice phishing) and spear-phishing both rely on establishing false credibility quickly. Voice- and text-based social-engineering tactics already succeed at a 40% higher rate than email-based ones in simulated attacks, according to Verizon’s 2026 Data Breach Investigations Report.⁴ A caller or message that references a specific home address, a spouse’s name, or a child’s school is more convincing than one that doesn’t. The same details that make an executive findable in person make them findable over the phone or by email.

The expert search went beyond a basic people search site lookup, drawing on public records and other open-source information. Social media was used primarily for context rather than as a direct source of addresses or personally identifiable information (PII). The exact search process is not disclosed, in the interest of safety.

Security expertise does not eliminate personal exposure

The difference between CEOs and CISOs is notable. CISOs were harder to locate than CEOs in finance and healthcare, though the small sample means this result should be treated as preliminary rather than conclusive. This raises a question: does greater familiarity with security and privacy practices translate into a smaller personal digital footprint?

That gap has particular relevance in finance and healthcare. Both sectors handle high volumes of wire transfers and payment authorizations, and both are frequent targets of CEO fraud, a business email compromise (BEC) scheme that impersonates a chief executive to pressure staff into an urgent, unauthorized transaction. The scheme depends on a convincing impersonation: the more an attacker can learn about a CEO, the more credible the request appears. CEOs are more discoverable than CISOs in exactly the two sectors where this scheme is most common. This is not likely to be a coincidence. The executive whose identity is most useful to impersonate is also the one most exposed.

The energy sector complicates that picture. CISOs proved more discoverable than CEOs in the manual search. This may point to sector-specific blind spots in personal privacy practices, where strong institutional security does not necessarily translate into equally strong protection of executives’ personal information.

Corporate breaches have accelerated sharply since 2018

This section focuses on publicly traded companies as categorized by Stock Analysis.⁵ The analysis included 2,401 companies: 254 energy, 1,056 healthcare, and 1,091 financial services companies.

Data breaches have increased in recent years across the healthcare, energy, and financial sectors.

From 2008 through 2017, reported breach volumes across all three sectors remained low, rarely exceeding 5 breaches per year. Breach activity began rising across all three sectors starting in 2018.

Financial-sector breaches increased the fastest, peaking at more than 40 reported incidents in 2023 and remaining high in the years that followed. Healthcare increased more gradually, reaching more than 30 reported breaches in 2026 at the time of data collection. The energy sector recorded fewer breaches overall.

These totals need context. The analysis included 254 energy companies, compared with 1,056 healthcare companies and 1,091 financial companies. The lower number of energy-sector breaches partly reflects the smaller sample size, and should not be read as evidence that the sector is more secure.

Employees are increasingly part of the breach story

Corporate breaches do not affect customers alone. Employee data exposure is also a concern. Of the 368 reported breaches identified in the analysis, 70 included reports that employee data had been exposed. Of those 70 cases, 34 occurred from 2024 onward, suggesting that employee information is appearing in breach disclosures with increasing frequency.

This matters because employees generally have limited control over how much personal information their employer stores about them. A corporate breach can become a source of personal exposure for the workforce, not only for customers.

This exposure also has an operational dimension, distinct from the executive-impersonation risk discussed elsewhere in this report. BEC schemes do not only rely on the impersonation of a CEO. They frequently target the employees positioned to act on a fraudulent request: accounts-payable staff who process wire transfers, finance employees who approve invoices, or mid-level employees who are impersonated by attackers to deceive other mid-level employees. The rising presence of employee data in breach disclosures means the pretexting material available to an attacker is not limited to leadership. It extends to the staff who actually initiate and approve payments—arguably the more operationally relevant exposure for a scheme that depends on completing a specific transaction.

The most exposed corporate information may be the most ordinary

Personal information is only one side of the breach problem. The same incidents can also expose internal and proprietary materials that reveal how an organization operates. This kind of exposure has increased in frequency in recent years.

Incidents involving proprietary information rose sharply between 2016 and 2026, driven primarily by breaches of internal documents and emails. Cloud infrastructure keys, source code, and intellectual property consistently featured in under 6 reported breaches per year. Internal-document and email exposures accelerated after 2022, reaching a peak of more than 20 incidents in 2024 and remaining elevated at approximately 19 annual incidents through 2026.

High-value corporate information is often associated with source code, intellectual property, or infrastructure credentials. Internal emails and documents can reveal just as much: internal relationships, workflows, projects, and other operational context.

This operational context has particular value to an attacker: it is the raw material of social engineering. A phishing email that guesses at a company’s structure is easy to dismiss. One that correctly names a real vendor, references an active project, or cites a manager by their actual title is harder to distinguish from a legitimate request. That specificity is exactly what a breached internal document or email thread provides. This is particularly relevant to business email compromise (BEC), a scheme that depends on convincingly impersonating an internal voice rather than exploiting a technical vulnerability. The steady rise in internal document and email breaches may reflect a growing supply of the material that makes impersonation-based attacks effective.

The Brian Thompson case referenced earlier in this report illustrates the same mechanism without any breach involved. During his federal guilty plea hearing in August 2026, Luigi Mangione, who pleaded guilty to the killing of UnitedHealthcare CEO Brian Thompson, told the court that he had contacted the company directly by email and phone, posing as an investor representing a multibillion-dollar firm, to learn the location of a private investor conference Thompson would be attending.³ No system was compromised and no data was stolen. A sufficiently plausible pretext presented to a legitimate business function was enough to extract information the company would not otherwise have disclosed to a stranger. The lesson extends beyond this case: pretexting does not require attackers to already possess breached material. It only requires a story specific enough to be believed.

More than 3 months remained in 2026 at the time of data collection. The final annual figure may rise further.

Executive privacy is becoming a corporate security issue

For this analysis, we selected 10 prominent companies in each of the three sectors and investigated the online exposure of their C-level executives and board members on people search sites.

Approximately 700 individuals were initially identified. Of these, 618 were included in the final analysis, with the remainder excluded because their primary residence was outside the United States.

The analysis was designed to answer a simple question: how easily could someone begin building a profile of a senior business leader using only basic identifying information?

Personal information exposure among executives and board members varies significantly by sector. Across all three sectors, an average of 32.5% of executives and board members were likely discoverable on people search sites.

Financial-sector leaders recorded the highest rate at 39.1%, followed by healthcare at 30.6% and energy at 26.6%.

Unlike corporate systems, these records often sit outside the direct control of security teams. An organization can secure devices, enforce MFA, rotate credentials, and train employees against phishing tactics while personal information about senior leaders continues circulating through third-party databases.

A company can patch a server. It cannot patch a home address once that information has spread across the public-data ecosystem. An exposed address or family detail does not stop being useful to an attacker the way a patched vulnerability does. It remains available for the next phishing email or phone call indefinitely.

When cyber risk becomes physical risk

Across every metric in this report, one pattern holds: the sectors where executives are easiest to find are also the sectors most likely to experience a breach, and the risks that follow it. Financial services had the highest executive exposure on people search sites (39.1%) and the highest rate of discoverable CEO home addresses in the manual search (8 out of 10, found in 10 minutes each). It also had the highest share of reported corporate breaches (19%). These are not three unrelated data points. Exposure is the starting condition. Breach and physical risk both follow from it, along two separate paths.

The first path runs through breach. The vishing, spear-phishing, and CEO fraud tactics described earlier in this report depend on an attacker already knowing enough about a target to be believed: a home address, a family member’s name, a manager’s title, a vendor relationship. Wherever that information is already public, it becomes the material an attacker uses to get past an employee and into a company’s systems. In a sector defined by wire transfers and payment authorizations, this pathway carries particular weight. 86% of business email compromise losses in 2025 moved through wire transfer or ACH, according to the FBI’s Internet Crime Complaint Center.⁶

The second path does not require a breach at all. The manual investigation documented in this report located a home address in minutes using only public records and open-source information, no compromised system involved. The killing of UnitedHealthcare CEO Brian Thompson, discussed earlier in this report, shows what that path looks like in practice. His location was obtained through surveillance and a fabricated pretext, not stolen data. Exposure alone was sufficient.

Once a breach does occur, it compounds both paths rather than resetting them. Breached material (personal details, internal documents, employee records) is often released publicly and cannot reliably be retracted. Internal documents and emails supply exactly the kind of detail an attacker needs: vendor names, project timelines, reporting lines. They have outpaced source code, intellectual property, and infrastructure keys as a breach category every year since 2022, peaking at over 20 incidents in a single year. Employee data follows the same trajectory: 34 of the 70 breaches involving employee data occurred in 2024 or later, adding the staff who process and approve payments to the pool of exploitable, permanently available information. A breach does not create a single, contained incident. It adds to the store of information available for the next attack, or the next attempt to locate a target.

This is why exposure, not breach, is the point of leverage. Once personal or corporate information becomes public, whether through a people search site or a breach disclosure, it is difficult or impossible to fully remove. Limiting what is available before either happens is the more reliable way to reduce both risks.

Security leaders report rising concern for executive safety

The organizations responsible for protecting them are seeing it too. The rising concern about executive safety noted at the outset of this report is not abstract.

Security leaders translate it into specific, near-term expectations. According to the Allied Universal report, among healthcare security leaders surveyed, 31% cited malicious damage to company property, 29% fraud, and 20% violence against people as genuine external threats over the next 12 months. In energy, the same categories came in at 18%, 22%, and 8%, respectively. Across all US respondents, the averages were 28% for fraud and property damage and 20% for violence against people.¹

These figures do not establish that online exposure leads to physical threats. The relationship documented here is one of overlap, not causation. The data does show that this concern is shared by the organizations responsible for security, and that they expect it to materialize within the year, not as a distant hypothetical.

That gap is partly structural. Executive personal exposure does not fall cleanly under any single function's mandate. IT and security teams are typically accountable for the corporate perimeter, not for what a people search site publishes about a CEO's home address. HR and legal may be positioned to think about an individual's welfare, but rarely have visibility into breach data or people search site exposure. Privacy teams, where they exist, are often scoped around regulatory compliance rather than physical safety. The result is a category of risk several functions touch, but none clearly owns.

Executive privacy no longer sits inside a single function. It touches digital security, corporate risk, and physical safety all at once. The organizations examined in this report are already treating it that way, even where their tools and processes have not caught up yet.

Methodology

Three main methodologies were used for this study.

First, to study the potential impact that people search sites have on the privacy and safety of C-level executives and board members, Incogni investigated all top-level businesspeople from a select list of companies. Researchers checked for the availability of these individuals' personal information online, specifically on people search sites.

The list of top-level businesspeople was created on August 12, 2026. Incogni's researchers then sought out minimal, publicly available information so they could check these individuals against PSS (people search site) records. Using Incogni's proprietary system, researchers checked whether the individuals were available on any of over 250 people search sites.

For every individual data point used to query the PSS (name, surname, age, city, and state), a match ranking in the range 1–100 was assigned. In cases where personal details were found to be a partial match, such as spelling variations or a slight difference in age, the match ranking for that data point fell below 100, based on the magnitude of the difference between the query and the potential match. The match rankings for every data point were then averaged and presented as an overall match ranking, expressed as a percentage. For this study, 75% was chosen as the match probability at which a top-level business leader was deemed likely discoverable on people search sites.

The second methodology examined how discoverable senior leaders were to a knowledgeable researcher using publicly available resources, specifically "well-informed" human actors who know where to look. Our privacy specialists spent an average of 10 minutes per individual manually seeking out the addresses of chief executive officers (CEOs) and chief information security officers (CISOs; or equivalent roles) at the manually selected companies. In total, 60 individuals were investigated. Ironwall and Incogni have chosen not to share the exact means through which this search was conducted, but it included public records and other sources.

Third, researchers created a list of over 2,400 publicly traded companies across healthcare (including insurance), finance (banking, money transfers), and energy (energy producers). The names of the companies were put into a search query on various search engines alongside a set of keywords such as "data breach" and "ransomware attack."

The results of these searches were first screened using an LLM to identify potentially relevant media coverage. They were then manually reviewed and researched to confirm the breach occurred and was reported by a reputable news outlet. Reported numbers of clients or employees affected, along with other relevant details, were saved from the original news sources.

If you have questions about this piece or any of our research, you can reach out to us at [email protected].

Use of visuals

Notwithstanding the terms of the CC BY-NC-SA 3.0 licenses of the visuals above, Incogni grants news organizations and other media entities permission to use the specified asset(s) in their news coverage or commentary, including on pages that display advertising.

The visuals can be downloaded or embedded using the menu at the top right of each visual. Embedded visuals preserve their interactivity.

References

1. Allied Universal. 2025 World Security Report. Accessed August 28, 2026. https://www.worldsecurityreport.com/.  With permission from Applied Universal
2. U.S. Attorney's Office, Southern District of New York. "Luigi Mangione Pleads Guilty in Connection with His Murder of United Healthcare CEO Brian Thompson." Department of Justice. Accessed September 2, 2026. https://www.justice.gov/usao-sdny/pr/luigi-mangione-pleads-guilty-connection-his-murder-united-healthcare-ceo-brian.
3. "Luigi Mangione Admits to Shooting UnitedHealthcare CEO as He Pleads Guilty in Federal Case." ABC News. Accessed September 2, 2026. https://abcnews.com/US/luigi-mangione-guilty-plea-expected-announced-friday-federal/story?id=135607454.
4. Verizon. 2026 Data Breach Investigations Report — Executive Summary. Accessed August 28, 2026. https://www.verizon.com/business/resources/executivebriefs/2026-dbir-executive-summary.pdf.
5. StockAnalysis.com. "Stock Analysis." Accessed August 12, 2026. https://stockanalysis.com.
6. Federal Bureau of Investigation, Internet Crime Complaint Center. 2025 Internet Crime Report. Accessed August 28, 2026. https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf.