TL;DR: No single post gives away anything sensitive. Stack five of them together and you’ve got a home address, an empty house, and a kid’s school. That’s the aggregation problem, and it’s the same technique nation-states use to build profiles on entire organizations, not just one person.
Meet Jenna#
Marketing manager, mom of two, posts like everybody else:
🏃♀️ 6am loop done. Same route, same time, coffee earned. #morningrunclub
Landing in Cancun in 3 hours!! ✈️ 5 days of doing absolutely nothing 🍹
First day of 3rd grade!! 📚 Mia is SO excited for Ms. Rodriguez’s class at Lincoln Elementary. Favorite subject: art. When she grows up: a vet! 🐾
Throwback to my first car, this thing was a DEATH TRAP lol. RIP Buttercup.
Excited to share I’m now leading the East Region team at [Company]!
Five scrolls. Zero red flags. Totally normal week on Instagram.
Now here’s what I see when I open that same feed wearing my other hat.
The Breakdown#
- Running post → the loop starts and ends at the same spot every time. That spot is her house. I don’t need her address, she mapped it for me. (This isn’t hypothetical. Strava’s public heatmap did exactly this at scale in 2018, outlining active military bases from soldiers’ running routes.)
- Cancun post → exact departure time, exact return window, house confirmed empty. I now know when nobody’s home.
- Chalkboard post → her daughter’s name, age, grade, teacher, and school: a full profile in one photo, plus enough personal detail (favorite subject, dream job) to fake being a family friend in a pretext call.
- “First car” post → that’s a security question answer. “What was your first car” is still live on more password resets than it should be.
- Job announcement → her employer, her title, and now I know her work email format and who to spoof if I want to send her a “reset your credentials” email that looks like it came from IT.
Individually, every one of these is harmless. Nobody’s oversharing. That’s the whole point. I didn’t hack Jenna. I read her. No breach required, just public posts and a little patience. This is the aggregation problem.
This one’s not hypothetical, either. Police departments across the country put out the same warning during back-to-school season this year: those “first day of school” chalkboard photos hand over your kid’s name, age, teacher, and school in a single frame, and the yard sign or street number in the background finishes the address. Multiple police departments flagged it. This is the exact same chalkboard post Jenna just made.
Now Scale That Up#
I did that as one guy scrolling for fun. A nation-state does it with a team, a budget, and months of patience. They’re not just profiling one Jenna. They’re profiling everyone in her building, her company, her kid’s school district, all at once.
Same five posts, different math:
- The running loop isn’t just “here’s her house” anymore. Cross-referenced against a dozen other employees at the same company, it maps the whole neighborhood’s commute patterns and home addresses in an afternoon.
- The vacation post gets logged against a calendar. Do it enough times, across enough employees, and you’ve built a live staffing map: who’s out, when, and how thin the office runs on any given week.
- The chalkboard photo works as corroboration. It confirms the school, which confirms the neighborhood, which confirms the home address already scraped from three other posts. Nation-states don’t need one good clue, they need three mediocre ones that agree with each other.
- The security-question post gets filed away and never used immediately. It sits in a dossier for eighteen months until it’s useful: for a password reset, a targeted phishing email, or a pretext call to IT.
- The job title change gets matched against LinkedIn’s whole org chart. Now they know who reports to whom, who just got promoted into access they didn’t have before, and who’s the softest target to approach first.
Here’s the part parents don’t expect.
Usually the kid is the leverage.
Nobody’s coming after a data-center admin’s badge by brute-forcing his credentials when it’s easier to text him his daughter’s name, school, and a photo of her at pickup. Security teams call it coercion: rattle or blackmail the parent through the child to get compliance, access, or silence. No hacking required, just the dossier Jenna’s feed already built for free.
That’s opportunistic versus targeted: I was pattern-matching for fun on one profile. A state actor runs the same aggregation, automated, across an entire employee roster, looking for the one person whose “harmless” posts line up into a usable access path, or a usable pressure point.
Intelligence services use this same logic, sometimes called mosaic theory, to justify classifying things that seem harmless on their own: the pieces spell out the secret when you read them together.
The Fix#
Know which combinations turn harmless into exposed, and build the habit of asking “what does this tell someone alongside my last five posts” before you hit share.
Greymantle Risk Advisory helps organizations find out what they’re leaking before someone else does. If you want a second pair of eyes on what your team is exposing without knowing it, get in touch.