Phishing Scams Are Getting Smarter — And Your Public Data Is Fueling Them

Security experts warn that freely available online information is giving cybercriminals everything they need to craft convincing attacks against organizations and their people.

Publicly accessible personal information — the kind sitting on "people search" websites with no technical skill required to find — is quietly becoming one of the most dangerous tools in a cybercriminal's arsenal. Ron Zayas, Chief Executive Officer at Ironwall by Incogni, is sounding the alarm on how this overlooked threat is reshaping the phishing landscape for organizations of every size.

Zayas shared his insights in a recent episode of Lock It Down, the official podcast of Security Magazine, hosted by Managing Editor Jordyn Alger and published September 30, 2026. His message was direct: the information already out there about your executives and employees may be all a bad actor needs to launch a highly convincing attack.

---

The Open-Source Threat Hiding in Plain Sight

Most people assume cyberattacks require sophisticated hacking tools or deep technical expertise. The reality in 2026 is far more unsettling. Zayas explained that bad actors do not need to breach a database or deploy malware to gather damaging intelligence on a target. They simply need to know where to look.

People search sites — platforms that aggregate names, addresses, phone numbers, employment history, and other personal details — are freely accessible to anyone with an internet connection. These sites pull information from public records, social media profiles, and data broker repositories. For a cybercriminal building a profile on a corporate executive or a mid-level employee, these platforms offer a ready-made dossier.

"Even information found on 'people search' sites can pose a threat to individuals," Zayas said during the podcast episode.

For organizations, this creates a cascading risk. When a bad actor knows where an executive lives, who they report to, what conferences they attended last quarter, and what their professional connections look like — crafting a phishing email that feels entirely legitimate becomes dangerously simple. The attack doesn't begin with a click on a malicious link. It begins weeks earlier, during the reconnaissance phase, when a criminal is quietly assembling a detailed picture of their target using nothing more than an internet connection and publicly available data.

This is a pattern security researchers have documented with increasing frequency. The CISA's phishing guidance and resources highlight how open-source intelligence gathering has become a standard precursor to targeted phishing campaigns — a threat that demands organizational awareness well before an attack is launched.

---

How Modern Phishing Schemes Exploit Personal Data

The Evolution Beyond Obvious Attacks

Phishing has evolved well beyond the poorly written emails promising lottery winnings or urgent wire transfers. Today's phishing attempts are carefully constructed to mirror real communications from known contacts, legitimate institutions, or trusted colleagues. Zayas described these as "carefully crafted phishing attempts" — attacks that leverage publicly available personal data to add layers of credibility and lower a target's defenses.

The mechanics work like this: a bad actor uses open-source information to personalize a phishing message with specific details that only someone familiar with the target would plausibly know. A reference to a recent business trip, a mention of a colleague's name, or an email address that mimics a known vendor can be enough to bypass a cautious employee's instincts.

One particularly effective tactic is clone phishing, where attackers duplicate legitimate emails and make only minor alterations — swapping out a link or attachment — before resending the message from a spoofed address. Because the email appears nearly identical to one the recipient has already seen and trusted, the psychological barriers to clicking are significantly reduced.

Recognizing the Red Flags

Zayas identified several red flags that security-aware employees should be trained to recognize, even in the most convincing phishing schemes:

• Unexpected urgency or pressure to act quickly without verification
• Requests for sensitive information through unofficial or slightly altered communication channels
• Messages that reference real personal details but arrive through unexpected pathways
• Links or attachments that were not anticipated based on prior conversation

The challenge for security leaders is that these signals are increasingly subtle. As phishing schemes incorporate more accurate personal detail, they become harder to distinguish from legitimate correspondence. Understanding the full range of phishing attack types and how each one operates is an essential foundation for building effective defenses — both at the organizational and individual level.

---

Strengthening Security Training for a More Sophisticated Threat

Closing the Gap in Awareness Programs

The conversation Zayas had with Security Magazine points to a critical gap in how many organizations currently approach security awareness training. Traditional training programs were built to catch obvious phishing attempts. The current threat environment demands something more adaptive.

Zayas outlined a framework for how security leaders can evolve their training programs to meet this challenge. First, organizations need to acknowledge that the threat is not purely technical. The human element — employees who are targeted precisely because of their accessibility and visibility — must be treated as a primary security concern rather than a secondary one.

Training programs should be updated to reflect real-world examples of sophisticated phishing attempts. Generic simulations using obviously suspicious emails no longer prepare employees for what they will actually encounter. Scenarios should incorporate the kind of personalized detail that bad actors now routinely use. For organizations looking to build more resilient teams, investing in structured cybersecurity awareness training across all levels of staff is one of the most effective steps available — particularly when that training evolves alongside the threat landscape rather than lagging behind it.

Addressing the Root of the Data Exposure Problem

Security leaders should also address the root of the data exposure problem directly. Zayas emphasized that organizations have an opportunity — and arguably a responsibility — to reduce the publicly accessible information footprint of their executives and key personnel. This means actively monitoring and requesting removal of personal data from people search platforms and data broker sites.

The analogy is worth considering: in a well-executed heist, the groundwork is laid long before anything is taken. Reconnaissance happens quietly, methodically, and well in advance. In the context of modern phishing, that reconnaissance happens online — and the most effective countermeasure is removing the information before it can be weaponized.

What Security Leaders Should Prioritize

Organizations that act on this information can reduce their exposure in meaningful ways. Security leaders should consider the following priorities:

1. Audit the digital footprint of high-risk personnel — including executives, finance staff, and IT administrators — to understand what information is currently accessible.
2. Redesign training programs around realistic, personalized threat scenarios rather than outdated generic simulations.
3. Establish data hygiene as a formal practice — the active management and reduction of publicly accessible personal information should be treated as an ongoing organizational responsibility, not a one-time task.

---

The phishing threat is not going away. But with updated training, a clearer understanding of how bad actors source their intelligence, and a proactive approach to reducing public data exposure, organizations can build a meaningfully more defensible posture against attacks that are growing more convincing by the day.