Why Executive Families Need Cybersecurity Training Too
An attacker attempts to breach an executive’s personal laptop, but effective multifactor authentication (MFA) blocks them. Actually, it was only a deterrent. The attacker then discovers that the executive’s son did not enable MFA on his gaming console and uses that compromised box to move laterally on the home network to eventually reach the corporate network.
Cybercriminals’ increasingly brazen techniques have expanded beyond office walls to target top executives’ family members and friends who may not know how to protect themselves. Worse, these people don’t even know that the attackers are coming for them. While leadership receives ongoing security awareness training on password hygiene and how to recognize signs of phishing and vishing, those closest to them are still vulnerable. Artificial intelligence (AI) also now offers new tools to exploit them
In March, Google Cloud’s Office of the CISO warned that personal attacks against executives are on the rise. The team urged boards to consider how they support them and their families in implementing effective social media settings, given that attackers routinely use that avenue for reconnaissance. Indeed, everyone now has an enormous digital footprint, allowing attackers to map out a household’s relationships, routines, and locations without ever touching a network, says Brian Hill, field chief information security officer (CISO) of client advisory at BlackCloak.
Attacks branch into three categories: impersonation, compromising the household’s devices, and phishing or smishing — a tactic aimed at less-technical family members. However, the consequences aren’t just digital, Hill says. A leaked itinerary or home address can turn into physical surveillance, a break-in, or extortion.
«Even something as harmless as a child’s school play on a shared calendar can give an attacker exactly the timing they need for a fraudulent wire request,» Hill tells Dark Reading.
It May Not Be New, But It Works
The tactic of using executives’ confidants to conduct social engineering campaigns, assist with account takeovers, or provide clues that help an attacker guess passwords is not a new phenomenon.
In a 2023 Ponemon Institute study with BlackCloak, 42% of respondents reported that key executives and family members had experienced at least one attack by a cybercriminal. That same year, Dragos blocked a ransomware attack where a threat actor contacted family members after an executive ignored ransom demands. Mandiant’s CTO, Charles Carmakal, warned during RSAC Conference in 2024 that cybercriminals were targeting executives’ children in SIM swapping attacks. Attackers contacted executives using those phone numbers, adding pressure on ransomware victims to give into payment demands.
The latest research from Ponemon and BlackCloak shows that 51% of organizations reported attacks on their business leaders in 2025, up from 43% in 2023, Hill says. In the cybersecurity and digital privacy company’s own onboarding of new clients, 39% of executives had devices that were already compromised without their knowledge, and 20% had unmonitored, open-access home networks.
«Every one of those gaps is shared with the people they live with,» Hill says. «[Targeting family members] is not only common, it is one of the most predictable paths an attacker will take.»
Bad actors have always been opportunistic, and everyone is at risk when it comes to using family or friends to get to a VIP, says Erich Kron, CISO advisor at KnowBe4.
Executive-targeted social engineering, known as «whaling,» has been around for quite some time, he adds, explaining that threat actors target someone close to the executive to exploit their family’s or friend’s trust and relationship while trying to harvest sensitive data.
«Family members and friends tend to be less trained and less protected than high-level executives,» Kron tells Dark Reading. «Therefore it is easier for cybercriminals to earn their trust and perform malicious actions.»
The Less Information, the Better
AI is compounding the problem, especially when it comes to reconnaissance. It can scan social media platforms or public records seven times faster than manual reconnaissance, which allows attackers to identify family and friends far more easily, Kron says.
It’s important to remember that attackers don’t necessarily view someone’s personal and professional lives as separate, notes Matt Hull, vice president of cyber intelligence and response at NCC Group, which has tracked this trend over the years. Details that appear harmless, such as interests, hobbies, or even fitness and location-based services, can potentially reveal routines, or patterns of behaviors, he says.
«NCC Group has previously described how cybercriminals tend to target people based on the information they can gather, rather than beginning with a fixed method of attack,» Hull tells Dark Reading.
Although an indirect attack, like compromising an executive’s loved one or executive assistant, increases the number of actions that may fail, it actually increases the likelihood of success, explains Jeremy Banon, CEO and founder of The Cyber Health Company.
«In the last 12 months, we have seen this pick-up significantly,» Banon tells Dark Reading.
Tips and Tricks
Addressing the challenge begins by acknowledging the reality, says Banon, adding how important it is for relatives to tighten their security postures because «hopping from vulnerable family member to the eventual target is easier than ever.»
While the top advice is to reduce digital footprints, that’s nearly impossible these days. But people can take steps in that direction. For example, they can remove their legal names from usernames and profile photos on social media. The same is true for WhatsApp, Apple contact cards, and personal emails, Banon adds.
«Aliases are your friend,» he says.
Ideally, excellent password management and MFA adoption means not using SMS, which attackers can intercept and abuse, and ensure SIM swap protection for the entire family.
Some social media accounts and experts promote the idea of crafting and using family safe words to prove legitimacy, but Banon says he is skeptical.
«I don’t think they’re harmful, but I’m pessimistic this works,» he says. «If you text your safe word once, it’s burned. Then you need a new safe word.»
Family members must also be mindful of podcasts or social videos they create because attackers can easily use them to conduct impersonation scams, cloning the voice and calling the spouse with an urgent request, Hill explains.
Less technically inclined family members need to be aware of QR code lures, fake delivery notices, and messages impersonating banks or schools. If attackers control their accounts, they can access family chats, calendars, and email threads that contain travel plans, financial details, and business information.
«Encourage family and friends to learn about scams and how modern cyberattacks work so they can quickly identify and ignore or report social engineering attempts,» Kron advises. «In our modern digital world, just knowing someone important can put you on a much more targeted list.»
Este contenido de ciberseguridad nos ha llegado de: DarkReading
Podrás encontrar la noticia original en el siguiente enlace: https://www.darkreading.com/cyber-risk/security-threats-don-t-stop-at-the-office-why-executives-families-need-training-too
