OSINT: What the World Knows About You (and your District’s Staff)

October is Cybersecurity Awareness Month. Learn more about how the LTC can make your school’s team more cyber-aware with staff trainings, consultations, and resources →

Several years ago, before generative AI’s arrival, it was commonplace for my co-workers at my school to receive unsolicited text messages related to their work. These texts usually asked them to take some out-of-band action or fulfill a data-related request, always posing as coming from a trusted source.

As I learned later, they were targets for “smishing” or SMS phishing, a popular cyber attack strategy that’s effective because:

• Virtually everyone has a texting-capable phone on them at all times (potentially including a work phone)
• Most people have an isolated view of their data 

That second point is particularly relevant to professional settings, including schools. As it turns out, school staff have a lot more data out in the world that can be used to turn them into a soft target for a cyber attack.

There’s no sugar-coating it: our digital-connected lives are not particularly private. We share a significant amount of personal information through the social media and other websites we use daily, not to mention when more sensitive data leaks out through malicious data breaches.

But despite that reality, most of us – our school co-workers included – maintain a basic level of trust based on our assumptions about what personal data remains “private”. 

Using my co-workers as an example, they might trust a work-related text purporting to be from a supervisor at first glance. They may assume “no one has my phone number”, leading them to jump to conclusions and follow-through with the text’s request.

But anymore, threat actors can learn a massive amount about a target in a short time period, thanks in part to open source intelligence (OSINT). This type of intelligence, gathered from publicly or commercially available information, offers attackers a practical way to create bait that hooks targets by exploiting their trust.

After one smishing incident at my school, I dug deeper and saw OSINT’s potential for myself. Within two hours, I had identified legitimate sites that contained all the data used in the attack. From there, I was able to outline exactly how the threat actors had stitched the data together and harnessed it to create a semi-plausible attack. 

My biggest takeaway: this kind of attack was easy to facilitate, and in time, it would likely become more common at our school

Data thieves don’t rest. In the past month, cybercriminals have struck Florida’s Highway Safety and Motor Vehicles, a Louisiana-based identity verification company, and a healthcare company’s patient records, just to name a few. 

In addition to theft, there’s legal access: data gathered and sold by service providers, plus public records – all collected by companies called data brokers. We can pay companies to remove our data from these brokers, but once it reaches bad actors, it stays there permanently.

Whether through data brokers or through direct access, all of that data fuels OSINT. With just enough OSINT, attackers can take advantage of a target’s trust with ease.

Fast forward to the age of generative AI. The two hours of work I did a few years ago can now be done in minutes. And those minutes don’t produce just one target, but hundreds or thousands of viable targets. 

School districts are even more vulnerable to these attacks. All of our hiring is public by statute, placing records into the public domain. Districts produce board minutes and human resources reports with the names of new hires. District websites also contain phone numbers, names, and other correlated information.

Take those names, search both legal and illegal databases (maybe with an AI agent’s help), and geo-fenced connections start to form fast. In the past three years, this practice has become so common that I warn every new hire in the business and HR departments that they’ll receive these and other novel attacks during their first 60 days on the job.

If these types of attacks are becoming more common, what can districts do to prepare and respond?

First, we (and I mean *everyone*) needs to accept that due to data brokers, highly connected digital lives, and massive data breaches, our personal information is not private. We can no longer trust that our data is private. When we treat our data as private, it fosters trust in communication involving that “private” data. That trust is being exploited by novel attack strategies like smishing, and that vulnerability puts our schools at risk. 

Second, our school staff needs to unlearn our inherent trust in communications. Contacts and communication channels that we would have trusted in the past, based on their content or perceived privacy alone, now need outside verification. For example, if you have a text about a “suspicious” bank account withdrawal, don’t reply or call that number. Check your account using another method, such as calling the phone number on your debit card or the one listed on their website, or visit your bank to speak with a live teller. 

These steps together can help you and your staff become cyber-aware, protecting them and your institution from threats fielded by “private” data.

Addressing vulnerabilities fueled by OSINT is one way to keep your district ahead of emergent cyber threats. Strategy, and consistent leadership, can also go a long way toward keeping your district’s cybersecurity posture durable and resilient.

Our vCISO program offers fractional cybersecurity leadership and the big-picture perspective needed to understand, manage, and communicate cybersecurity risk.

Learn more about our program or explore how a vCISO excels at contextualizing decisions impacting cybersecurity for district stakeholders →