A VPN login for sale, a still-valid cookie, an IBAN making the rounds… Things move before your tools alert. The goal isn’t just to block; it’s to anticipate what each datum enables attackers to do — and what the law requires you to do next.
We mapped what each data type really enables attackers to do—and what it costs you, operationally and under EU law.
The risk table below is scan-friendly: on the left, the data type; in the middle, the attacker’s practical use; on the right, severity (🟡/🟠/🔴) and the relevant EU framework (GDPR, NIS2, DORA, PSD2, eIDAS, Trade Secrets). Use it to prioritize actions, prep your notifications (GDPR 72h, NIS2 24/72h), and kill first anything that grants direct access (tokens, sessions, keys)
🟡 moderate · 🟠 high · 🔴 critical
|
Data
|
What it enables in practice
|
Severity
|
EU Framework
|
|---|---|---|---|
|
Name, surname
|
Credible spear-phishing, basic impersonation
|
🟡
|
GDPR (Art.32 security, notify ≤72h)
|
|
Date & place of birth
|
Bypass weak ID checks
|
🟠
|
GDPR
|
|
Postal address
|
Delivery/billing fraud, doxxing
|
🟠
|
GDPR
|
|
Email
|
Phishing, resets, BEC
|
🟠
|
GDPR
|
|
Phone
|
Smishing/vishing, SIM-swap (SMS 2FA)
|
🟠
|
GDPR
|
|
IP / device fingerprint
|
Geo-targeting, tracking
|
🟡
|
GDPR + ePrivacy
|
|
IBAN/BIC
|
Bank-detail fraud, SEPA debits
|
🟠
|
GDPR; PSD2/DORA/NIS2 if in scope
|
|
Card data (PAN+exp+CVV)
|
CNP purchases, resale
|
🔴
|
GDPR; PCI DSS; PSD2 (for PSPs)
|
|
Statements/transactions
|
Profiling, tailored extortion
|
🔴
|
GDPR; PSD2/DORA/NIS2
|
|
National ID / SSN
|
Full identity theft (KYC/benefits)
|
🔴
|
GDPR Art.9 (special), DPIA
|
|
ID card / passport / license
|
Open lines/contracts
|
🔴
|
GDPR
|
|
Password (clear)
|
Account Takeover, stuffing
|
🔴
|
GDPR; NIS2 (technical measures)
|
|
Password (weak hash)
|
Likely cracking
|
🟠
|
GDPR
|
|
OAuth tokens / session cookies
|
Session hijacking, persistence
|
🔴
|
GDPR; NIS2
|
|
API / SSH keys
|
API/infra access, lateral movement
|
🔴
|
NIS2
|
|
TOTP seeds / backup codes
|
Neutralize MFA
|
🔴
|
NIS2 / GDPR (if personal)
|
|
Signing keys / certs
|
Supply-chain, signed malware
|
🔴
|
eIDAS (trust services), incident notice
|
|
Crypto seed phrase
|
Irreversible asset theft
|
🔴
|
GDPR if personal
|
|
Photos/videos (EXIF)
|
Deepfakes, doxxing (time/place)
|
🟠
|
GDPR
|
|
Biometrics (face/voice/iris)
|
Biometric bypass, non-revocable
|
🔴
|
GDPR Art.9
|
|
GPS traces / routines
|
Stalking, physical risk
|
🟠
|
GDPR
|
|
Ad IDs / cookies
|
Re-identification, fine targeting
|
🟡
|
GDPR + ePrivacy
|
|
Social accounts/graphs
|
Impersonation, reputational attacks
|
🟠
|
GDPR
|
|
Financials / budgets
|
Extortion, market manipulation
|
🔴
|
GDPR if personal; NIS2/DORA
|
|
CRM (customers/suppliers)
|
Spear-phishing, bank-detail fraud
|
🟠
|
GDPR; NIS2 (supply chain)
|
|
Bids / tenders
|
Sabotage, bid-rigging
|
🟠
|
Trade Secrets; NIS2
|
|
Roadmaps / pricing
|
Competitive loss, targeted scams
|
🟠
|
Trade Secrets
|
|
Trade secrets / algorithms
|
Durable competitive loss
|
🔴
|
Trade Secrets
|
|
Patents (unpublished)
|
Loss of novelty, appropriation
|
🔴
|
Trade Secrets
|
|
Source code
|
Backdoors, hardcoded secrets
|
🔴
|
NIS2; Trade Secrets
|
|
Architecture docs / cloud inventories
|
Faster lateral movement
|
🔴
|
NIS2
|
Multipliers (where risk explodes)
A single leak is a nuisance. Two combined leaks are a master key. Email + phone triggers resets, then a SIM-swap and your SMS 2FA is gone. An IBAN pasted onto a stolen invoice drives bank-detail fraud at your customers. The real danger isn’t A or B — it’s A+B at the right time. This section shows where risk explodes and what to neutralize first.
Email + phone + address → resets + SIM-swap → full ATO.
IBAN + invoices → bank-detail fraud against your clients.
OAuth token + SMS MFA → persistence despite password changes.
Source code + signing key → credible, devastating supply-chain.
Reality check (no jargon)
No theory: minute-by-minute how an attacker compounds a real-world leak. From a still-valid OAuth cookie to sticky OAuth apps, stealth mail rules to a relay VPS, you’ll see the exact moves that turn a quiet incident into a major crisis — so you can spot the pattern before it sets in.
Identity & contacts: SSN + ID scan pass “level-2” KYC; leaked phone → SIM-swap → SMS 2FA diverted → cascade resets.
Finance: IBAN + stolen invoice = bank-detail change at your customers; PAN/CVV = CNP in minutes.
Access: a valid OAuth cookie rebuilds footholds (OAuth apps, mail rules) and survives resets.
Enterprise: leaked CRM → fake “urgent” bank-detail emails; code + secrets → clean backdoor; roadmaps/pricing → competitor undercuts.
Images/biometrics: EXIF leaks time/place; voice deepfake unlocks a transfer; biometrics can’t be revoked.
Practical moves (playbooks)
Incident mode: stop the bleeding. The time-savers live here: revoke first (sessions/tokens/keys), kill footholds (rogue OAuth apps, mail rules, carrier port-out PIN), out-of-band confirm any bank-detail change, restore observability(M365/IdP/cloud logs), and rotate secrets cleanly. Simple steps, immediately actionable.
Revoke first: sessions/tokens/keys; global logout; rotate passwords/keys; enforce FIDO2.
Kill footholds: remove rogue OAuth apps, mail rules/redirects; carrier port-out PIN (anti SIM-swap).
Anti-payment fraud: block card/IBAN; out-of-band confirm any bank-detail change.
Make it observable: M365/IdP/cloud/API logs (impossible travel, new device).
Live inventory: asset/ML-SBOM (models, keys, datasets, repos) so you know what to rotate.
Look upstream: dark-web monitoring (credentials, VPN/RDP/M365 access for sale) to detect before the SIEM.
Share:
External Attack Surface Management
See your exposure before attackers do. Know what's already compromised.
of successful breaches start from publicly exposed assets.
