How Attackers Reconstruct You: Measuring Identity Exposure Across Four Attack Surfaces

How Attackers Reconstruct You: Measuring Identity Exposure Across Four Attack Surfaces

Speakers: Andreanne Bergeron, Data Scientist at Flare and Affiliated Professor at Université de Montréal

Conference: FIRSTCON

YouTube: https://www.youtube.com/watch?v=CAIntm7qZV0

Overview

In an era of relentless data breaches, the sheer volume of exposed personal information has led to widespread fatigue among the general public, often resulting in a perceived loss of control over one's digital identity. Andreanne Bergeron's FIRSTCON talk, "How Attackers Reconstruct You: Measuring Identity Exposure Across Four Attack Surfaces," tackles this critical issue by presenting a rigorous research methodology aimed at quantifying the actual value and potential harm of different types of personally identifiable information (PII). This research seeks to move beyond anecdotal understanding, providing a framework to assess which exposed data points pose the greatest risk, not just in terms of market price but also in terms of human impact and the crimes they enable.

Bergeron, leveraging her unique background in criminology alongside her expertise as a data scientist, challenges conventional wisdom regarding PII valuation. The core premise of her work is that not all PII carries the same weight; a breach exposing an old email address is fundamentally different from one revealing medical records or government identification. Her methodology explores economic and criminological perspectives, ultimately proposing an "exposure score" that accounts for the type, aggregation, recency, and source of compromised data.

The talk underscores the critical need for security professionals to understand the nuanced implications of PII exposure, particularly for non-experts who are often the ultimate victims of sophisticated attacks. By classifying PII into four distinct "attack surfaces"—Authentication, Financial, Identity, and Social Engineering—Bergeron provides a practical lens through which to evaluate risk and tailor defensive strategies, ensuring that interventions are adapted to the specific nature of the compromised information.

Background

▶ Watch: Introduction: The value of personal information (0:00)

The landscape of cybersecurity is perpetually marred by data breaches, a phenomenon so common that it has, as Bergeron aptly puts it, become "background noise." This constant barrage of breach notifications has desensitized individuals, fostering a sense of resignation where losing control of personal data is simply accepted as a part of modern life. This fatigue, however, obscures a crucial reality: the severity and implications of data exposure vary dramatically depending on the specific types of PII compromised. The challenge lies in objectively assessing this differential impact, a task often complicated by the inherent biases and varying perceptions of risk among individuals.

Bergeron highlights this perceptual disparity with a simple audience poll: Is a home address or a driver's license more dangerous to expose? Most instinctively choose the driver's license. The question becomes trickier with "travel habits" versus "personal health data," where answers diverge based on individual circumstances and the potential for targeted attacks. This illustrates that a universal understanding of PII risk is elusive, particularly for non-experts who may lack the contextual knowledge to assess the true danger.

The research is rooted in the understanding that the impact of a breach extends far beyond simple credential compromise. Bergeron cites two illustrative examples of severe PII exposure: the Mate1 dating website breach and a significant bank breach. The Mate1 incident, exposing 25 different types of deeply personal information from approximately 27 million users—including astrological signs, date of birth, drinking habits, drug habits, education level, fitness level, gender, geographic location, income level, job title, parenting plans, physical attributes, and political views—represented a profound privacy violation. The bank breach, on the other hand, carried a high potential for direct financial fraud due to the exposure of government-issued IDs, financial transactions, and marital status. These cases underscore that the volume of data is only one dimension of severity; the nature and intimacy of the PII are equally, if not more, critical in determining the potential for harm.

Key Findings

▶ Watch: Economic approach: PII market value and AI limitations (10:40)

Andreanne Bergeron's research yielded several crucial insights that challenge conventional understandings of PII value and risk:

• AI's Unreliability in PII Valuation: Initial attempts to use Large Language Models (LLMs) to price PII proved disastrous, generating inaccurate and nonsensical results with fabricated sources. This underscores the need for human-curated, scientifically validated data in this domain.
• Misalignment of Market Price and Human Harm: A significant finding was the stark divergence between the market price of PII on cybercriminal markets and the severity of legal sentences associated with its malicious use. Data types like credit card numbers and social media profiles may fetch relatively low prices but lead to severe legal penalties if exploited, while personal health data and PINs command high market prices but are associated with comparatively lighter sentences, indicating an arbitrage opportunity for threat actors.
• Super-Additivity of PII Bundles: The value of PII is not merely additive; combining different types of information often results in a "super-additive" effect, where the bundle's value for attackers explodes far beyond the sum of its individual parts. This phenomenon is a cornerstone of sophisticated identity reconstruction and targeted attacks.
• Contextual Value Reduction: Counter-intuitively, not all data combinations create value. Some pairings, such as job title combined with a physical address from an HR database, can actually reduce the perceived value of a breach if they lack actionable elements, signaling lower utility to attackers.
• Underestimation of Social Engineering Data: Security teams consistently underestimate the risk associated with social engineering data—intimate or contextual information that enables highly personalized and psychologically manipulative attacks. This category, encompassing details like travel habits, health status, relationships, and lifestyle, can be incredibly potent for extortion and targeted phishing.
• Low Price Does Not Equal Low Risk: PII that is cheap and abundant on the dark web, like email addresses, is often associated with high volume and noisy attacks but can still serve as a critical entry point or foundational element for more complex identity reconstruction when combined with other data.

Technical Deep Dive

▶ Watch: Criminological approach: market price vs. legal severity (18:30)

Bergeron's research meticulously dissects the concept of PII value through a multi-faceted approach, starting with a classification system for understanding potential harm and then applying both economic and criminological lenses.

The foundation of her analysis rests on categorizing the 91 different types of PII identified in their data into four attack surfaces, representing distinct forms of harm:

1. Authentication: PII that grants access to accounts, such as usernames and passwords. These are typically associated with immediate compromise and account takeover.
2. Financial: Information directly related to monetary assets, including credit card numbers, bank account details, and PINs. These enable direct financial fraud.
3. Identity: Data used to confirm or establish an individual's identity, often for governmental or official purposes. Examples include Social Security Numbers (SSN), passport numbers, driver's licenses, and dates of birth. These are critical for identity theft and impersonation.
4. Social Engineering: Contextual or intimate information that facilitates psychological manipulation and targeted attacks. This category includes highly sensitive data like travel habits, personal health data, political views, relationship status, job titles, and private communications.

Economic Approach: Market Price Valuation

Bergeron first attempted an economic approach to value PII based on its market price on cybercriminal forums. Recognizing the inherent flaws and fabrications of AI in this domain, her team meticulously built a dataset of 348 rows, representing the largest collection of PII sale information to date. This dataset captured sales of PII bundles, along with their prices and the number of affected users.

To derive individual PII values, an iterative mathematical model was employed. This model addressed the complexity of PII often being sold in bundles rather than individually. It started with unknown values for each PII type and iteratively refined them. In each step, the model assessed how much of a bundle's total price could be explained by already estimated PII types. The remaining value was then distributed across the unknown PII types present in that bundle. This process was repeated until the values stabilized. Prices were also normalized per year (to account for inflation) and per user (to determine the value for one individual).

The results of the economic model placed personal health data, PINs, bank account numbers, driver's licenses, and passport numbers at the top of the valuation list. Personal health data, in particular, stood out due to its irrevocable nature (medical history doesn't change), its enablement of significant fraud (insurance fraud, prescription fraud, long-term identity theft), and its richness of information. However, the model also presented anomalies, such as a license plate being valued at $62 while an SSN was only $4, which felt counter-intuitive given the public nature of license plates versus the protected status of SSNs. This highlighted a critical limitation: market price, while reflecting attacker demand, does not always equate to perceived risk or human harm. The model also struggled with PII that holds little standalone value but appears in high-value bundles, attributing a disproportionate price.

Criminological Approach: Legal Sentence Severity

To address the limitations of the economic model, Bergeron introduced a criminological approach, using the severity of legal sentences as a proxy for the harm caused by PII misuse. This approach posits that the law generally reflects societal norms regarding the gravity of crimes. A second dataset was constructed from media-reported cases and official United States attorney databases, documenting crimes related to PII from 2001 to 2026. This database captured instances where 43 different laws were broken, totaling 29 cases that explicitly involved the use of PII.

The same iterative mathematical model was applied to this dataset, using sentence length (in months) as the weighting factor. The results shifted the hierarchy: credit card numbers, social media profiles, Social Security Numbers, passport numbers, vehicle details, and personal health data emerged at the top. The criminological model successfully elevated the SSN to a more appropriate position. However, it also presented its own peculiarities, such as the high weighting of credit card numbers (despite bank reimbursement mitigating direct victim burden) and social media profiles (driven by severe cases like stalking). This model's limitations included its dependence on actual prosecution (not all PII misuse is caught or prosecuted) and the fact that sentence length is influenced by many factors beyond just the PII type, such as the number of victims or the judge's interpretation of the crime.

Comparison and the Arbitrage Opportunity

A direct comparison of the economic and criminological models revealed a significant misalignment between market prices and legal consequences. PII like credit card numbers and social media profiles, which are relatively cheap on the dark web, lead to high legal sentences if exploited. Conversely, personal health data and PINs, which command high market prices, are associated with comparatively lower legal sentences. This divergence highlights a clear arbitrage opportunity for cybercriminals: they can profit significantly from high-value data with a relatively lower risk of severe legal repercussions. This also indicates that high-value data attracts more sophisticated attackers, and that dark web prices reflect attacker strategies and utility, not just inherent risk.

The Aggregation Factor: Super-Additivity

A pivotal realization in Bergeron's research is the aggregation factor. PII is rarely sold in isolation; threat actors intentionally bundle information because aggregated data is exponentially more powerful. This phenomenon, termed super-additivity, means that the value of combined data is far greater than the sum of its individual parts. For instance, an email address and an SSN, each having minimal standalone value, can explode in utility when paired.

Historical examples underscore this: the 2014-2015 campaign targeting the US Office of Personnel Management (OPM, 21.5 million security clearance records), Anthem (78.8 million health insurance records), and United Airlines (passenger manifests) allowed state-sponsored actors to construct a comprehensive map of government employees' identities, health, and movements. More recently, "aggregation bots" found on Telegram channels demonstrate this real-time, automated capability, instantly compiling structured victim profiles from disparate breaches using just an email address.

Intriguingly, the research also found that not all data combinations create value; some can actually reduce it. A pairing like "job title" with "physical address," typical of an HR database, might be treated as low-value "failure data" by the market if it lacks actionable elements for attackers.

The Exposure Score

The culmination of this research is the conceptual framework for an exposure score. This proposed metric aims to provide a more accurate and comprehensive assessment of an individual's identity exposure by incorporating:

• Data Type: Considering the inherent harm associated with each PII category (Authentication, Financial, Identity, Social Engineering).
• Aggregation Effect: Accounting for the super-additive value created by PII bundling.
• Recency of Breach: More recent breaches generally pose a higher risk.
• Source of Information: The origin of the compromised data, distinguishing between, for example, highly sensitive "stealer logs" (from malware) and broader "combo lists" (from credential stuffing operations).

This multi-dimensional score provides a robust mechanism for security teams to prioritize interventions, communicate risks effectively to non-experts, and tailor protection strategies.

Demo / Proof of Concept

▶ Watch: Aggregation factor: PII value explodes when bundled (28:00)

While Andreanne Bergeron's talk did not feature a live, interactive demonstration of a specific tool or proof-of-concept, she extensively detailed the conceptual and methodological framework for her proposed exposure score. The research itself, with its iterative mathematical models and data aggregation analysis, serves as a robust proof-of-concept for the viability of systematically quantifying PII risk.

Crucially, the talk cited real-world examples that function as a de facto demonstration of the aggregation principle:

• Strategic Intelligence Collection: The combination of data from the OPM, Anthem, and United Airlines breaches by state-sponsored actors illustrated how disparate datasets, when aggregated, yield profound strategic intelligence about individuals (e.g., government employees' health status, travel patterns, and security clearance levels). This highlights the "super-additive" effect in action on a national scale.
• Automated Aggregation Bots: Bergeron described discovering "aggregation bots" on Telegram channels. These automated services accept a victim's email address as input and instantly return a compiled, structured profile aggregated from multiple breach databases, including passwords, linked phone numbers, names, and other PII. This serves as a concrete example of how threat actors are actively leveraging the power of aggregation to reconstruct identities rapidly and efficiently.

The development of the exposure score itself, integrating data type, aggregation effect, recency, and source of information, represents the practical application of her research findings. While not a runnable demo, its detailed explanation provides a blueprint for how security teams can build systems to assess and communicate identity exposure more effectively, moving beyond mere data quantity to focus on the quality and contextual danger of compromised PII.

Defensive Implications

▶ Watch: Key takeaways: Underestimated social engineering data and tailored responses (32:00)

The detailed analysis presented by Andreanne Bergeron offers critical defensive implications for organizations and individuals alike, emphasizing the need for adapted interventions based on the specific type of PII exposed. Her framework moves beyond generic breach responses to highly targeted protective measures:

1. Authentication Data (e.g., usernames, passwords): This category demands immediate and decisive action. Organizations must implement rapid password resets for affected accounts, invalidate all active sessions, and revoke any compromised authorization tokens. The speed of response is paramount here, as authentication data can be used for immediate account takeover.

1. Identity Data (e.g., SSN, passport numbers, driver's licenses): While not requiring instant action like authentication data, the harm from compromised identity data is often long-term and pervasive. Defenders should advise affected individuals to file fraud alerts with all three major credit bureaus immediately. For exposed phone numbers, coordinating telecom port freezes is crucial to prevent SIM swapping attacks, which can lead to further identity compromise and financial fraud. The focus here is on proactive measures to mitigate protracted identity theft.

1. Financial Data (e.g., credit card numbers, bank account numbers): When financial PII is compromised, organizations must promptly notify card brands and acquiring banks to initiate rapid card blocking. Adherence to regulations like PCI DSS is critical for compliance and minimizing financial loss. While banks often reimburse victims, the administrative burden and potential for linked fraud necessitate swift action.

1. Social Engineering Data (e.g., personal health info, travel habits, relationships, job titles): This category is consistently underestimated by security teams but holds immense power for attackers. The primary defensive implication here is the issuance of specific user notifications. If highly personal or contextual data is part of a breach, affected individuals must be informed that this information is now potentially public. This awareness empowers them to recognize and question highly contextualized phishing emails, spear-phishing attempts, or extortion threats. As Bergeron explains, attackers use such details to add legitimacy to their scams, making them far more effective than generic spam. Educating users about the psychological manipulation tactics enabled by this data is paramount.

Beyond these category-specific actions, the research highlights broader defensive shifts:

• Prioritize Human Harm over Market Price: Security teams should re-evaluate their breach assessment methodologies to prioritize the potential for human harm (as indicated by the criminological model and the nature of social engineering data) rather than solely focusing on the dark web market price of PII.
• Account for Aggregation: Defenders must understand that the threat is not just individual PII points but their aggregation. Protecting seemingly low-value data becomes critical when it can be combined with other information to create a high-value profile. Implementing robust data segmentation and minimizing PII collection can reduce the potential for devastating aggregated breaches.
• Enhanced User Education: The talk underscores the need for more sophisticated user education that goes beyond basic phishing awareness. Explaining the "super-additivity" of PII and the specific psychological tactics enabled by social engineering data can empower non-experts to be more resilient.
• Proactive Threat Intelligence: Monitoring for aggregation bots and understanding criminal arbitrage opportunities can inform defensive strategies, allowing organizations to anticipate which types of aggregated data are most attractive to threat actors.

Key Takeaways

• Social engineering data is critically undervalued by defenders. Information like travel habits, health data, and relationship details are potent for targeted psychological manipulation and extortion, yet often underestimated in breach assessments.
• Market price of PII does not equal human harm. The economic value of data on the dark web is often misaligned with the actual severity of harm and legal consequences it enables, creating arbitrage opportunities for criminals.
• PII bundling creates "super-additive" value for attackers. The combined value of aggregated personal information explodes exponentially beyond the sum of its individual parts, making data integration a powerful tool for identity reconstruction.
• Adapted interventions are necessary for different PII categories. Response strategies must be tailored to the specific nature of the compromised PII (Authentication, Financial, Identity, Social Engineering) to be effective.
• Personal health data and government IDs pose long-term, non-revocable risks. Unlike credit cards that can be canceled, medical history and government identifiers are permanent, making their compromise exceptionally dangerous for sustained identity theft and fraud.
• AI is not a reliable source for PII valuation research. Initial attempts to use LLMs for PII pricing yielded inaccurate, nonsensical results with fabricated sources, underscoring the necessity of rigorous, human-curated research.

About the Speaker(s)

Andreanne Bergeron is a prominent figure bridging the gap between social sciences and cybersecurity. She serves as a Data Scientist at Flare, a leading cyber threat intelligence company, where she applies her expertise to real-world security challenges. Concurrently, she maintains close ties with the academic world as an affiliated professor at the Université de Montréal, where she earned her PhD in Criminology. Her background in social science uniquely positions her research to focus on the human element of cybersecurity, particularly in understanding victim perspectives and explaining complex concepts to non-experts. Beyond her professional roles, Bergeron is actively involved in the cybersecurity community as an organizer of NSSE, a well-regarded cybersecurity event in Montreal. Her work consistently emphasizes the importance of understanding the human impact of cyber threats and developing accessible explanations for a broader audience.