The New Social Engineering Threat Starts With Public Employee Data

By Thomas Daly, CEO, mePrism Privacy

Cybersecurity teams spent years focusing on malware, phishing emails, and endpoint protection.

Groups like BlackFile are showing how much damage can happen without any of those things.

The group, also tracked as UNC6671 and Cordial Spider, has spent 2026 targeting retail and hospitality companies by calling employees directly on their personal phones while pretending to be internal IT support.

The attacks are simple.

An employee receives a convincing call about an MFA issue or account migration. They are redirected to a fake login page that closely resembles the company’s SSO portal. Credentials are captured in real time. MFA approval is intercepted. The attacker registers their own device and moves into systems like Microsoft 365, Salesforce, SharePoint, or Okta.

From there, data theft becomes automated.

What makes these attacks effective is not advanced malware. It is publicly exposed personal information.

Attackers already know:

• where employees work
• personal mobile numbers
• family relationships
• previous employers
• home addresses

That information is widely available across data broker platforms and people-search websites.

This is where workforce privacy and enterprise security now overlap.

Most organizations already invest heavily in endpoint security, cloud monitoring, phishing detection, and identity management. But many employees still have detailed personal profiles sitting publicly online across dozens or even hundreds of broker sites.

For social engineering groups, that data becomes reconnaissance infrastructure.

The retail and hospitality sectors are being hit especially hard because they often operate with large frontline workforces, frequent IT communication, and massive SaaS environments. But this attack model is not limited to one industry.

Any organization using centralized SSO systems and cloud applications faces similar exposure if employee data remains publicly accessible.

The standard recommendations still matter:

• phishing-resistant MFA
• stronger help-desk verification
• vishing simulations
• conditional access policies

But organizations are beginning to realize there is another layer underneath all of them: reducing the public exposure attackers rely on before the attack even starts.

That is one of the reasons we built Priwall by mePrism.

The goal is straightforward. Continuously identify exposed employee information across broker ecosystems and remove it before it becomes operational intelligence for attackers.

You can read the full analysis here:

https://meprism.com/blog/blackfile-social-engineering-data-brokers-2026