Page 210 - Cyber Defense eMagazine RSAC Special Edition 2025

• Social Media and OSINT Lookup: Many social platforms and apps let users find friends
by phone or email. Attackers can abuse these features (or their APIs) to discover your accounts. In fact,
Twitter disclosed that bots were uploading huge lists of phone numbers just to see which ones hit a
match, effectively building a reverse lookup database of users. A phone number plugged into people-
search tools or even Google can surface LinkedIn profiles, WhatsApp statuses, Skype IDs, or forum
posts. From one account, others often follow—your Instagram might reveal your full name, which leads
to a search that uncovers your other profiles, and so on. The web of connected accounts starts to light
up one by one.

• Password Reset and Account Recovery Routes: An exposed email address opens doors
via the password reset function on countless sites. A malicious actor who has your email can attempt to
reset passwords on popular services; even if they don’t succeed without access to your email inbox or
phone, they might learn which sites you use (some services inadvertently disclose whether an email is
registered). If they do have your email account (or convince an email provider or phone carrier to help
via social engineering), they can snowball into many other accounts by triggering password resets. This
domino effect is precisely how a compromised email led attackers to multiple connected accounts in one
incident.

• Cross-Service Identity Linking: Our digital identifiers are often used beyond login. For
example, if you use the same email for an e-commerce account, a social media profile, and a health app,
and one of those leaks it, criminals can correlate that email across different dumps or platforms to
assemble a richer picture (perhaps linking your email to a real name, physical address, or medical info
from separate breaches). They know people recycle personal information across platforms, so finding
one identifier in one place can validate that it’s the same person elsewhere.

From a privacy advocate’s perspective, this interconnectedness is alarming. It means that despite all the
passwords and security measures on individual accounts, your online life has a single point of failure: the
exposure of a secondary identifier. An opportunistic attacker doesn’t need to “hack” 20 different sites to
learn about you; they can simply pivot from one exposed ID. In practical terms, this could mean a stalker
starting with your cell number and ending up with your home address and family photos, or a scammer
starting with your email and discovering where you bank and shop. It’s a chain reaction of vulnerability—
one link weakens, and the whole chain can come undone.

The Cybersecurity Implications of Linked Identities

The fallout from a single identifier leak can extend far beyond embarrassment or nuisance; it raises
serious cybersecurity threats for individuals and organizations alike:

• Targeted Phishing and Scams: Once attackers know which services you use (because
they discovered your linked accounts), they can craft convincing phishing emails or texts. For instance,
if they uncover that you have an account at a particular bank or an online store, they can send you tailor-
made fake alerts appearing to come from those businesses. The success rate of phishing climbs when
the attacker has personal context. A trove of leaked phone numbers has already led to surges in SMS
phishing (“smishing”) attacks impersonating companies that users trust.

210