Executive Exposure Starts At Home. A Family Password Can Lead To The Company, 360 Privacy Says.

Estimated reading time: 8 minutes

360 Privacy found its median client’s home address on 112 sources at sign-up. Removed records began returning in a median of 21 days. Chuck Randolph says a leaked personal password is often a path to a work account. Executive protection in the digital plain.

Wiping an executive’s home address from the internet buys about three weeks.

Removed information first reappeared online after a median of 21 days, according to 360 Privacy. The company sells data removal and monitoring to executives, high-profile individuals and their employers. It sells continuous removal. The finding supports that business.

“Brokers re-ingest records from public sources and re-list them,” said Chuck Randolph, the company’s chief strategy officer. “Removal clears the listing. It does not clear the source.”

The figures come from 360 Privacy’s 2026 Annual Digital Exposure Report, released Oct. 20. It pairs a Wakefield Research survey of 300 U.S. security and wealth professionals with 360 Privacy’s own monitoring data. Randolph answered CINI’s questions in writing. He joined 360 Privacy Chief Security Officer Trinity Davis on CINI’s podcast in April 2025 to discuss personal cybersecurity.

It Starts With A Record

“It starts with a record and gets refined from a post,” Randolph said. Data brokers and property records supply the basics: name, address and family. Social media and family accounts add the pattern of life. That means where someone is and when.

When clients signed up with 360 Privacy, before any removal, the median client had personal details on 121 sources. The home address appeared on 112. “Not one or two listings. 112,” Randolph said. Just under 60% of exposure records also named a relative. Nearly all clients, 96.6%, had personal information a standard Google search could find.

Family members widen the gap. “In the cases I see, a family member’s account is frequently the weakest link,” he said. “It has the same connections and is afforded less protection.”

Cyberfort CEO Glen Williams described that path on CINI’s podcast in February. Someone had walked him through how they would reach a senior executive at a defense contractor. The executive himself was locked down, Williams said. His wife mentioned their daughters online. One daughter was getting married and wanted a family gym membership. The attacker then posted a gym offer that looked made for her. She clicked. “He’s into the daughter, then into the mother, then into the defense contractor,” Williams said. “It was the clicking on the gym voucher. That was the problem.” He offered it as an example of social profiling. He didn’t name the company or say the attack happened.

A Personal Password, A Work Account

On the dark web, clients with exposed credentials averaged more than 20 each. Of those, 86% had at least one password exposed in plain text.

360 Privacy doesn’t sort the credentials into work and personal accounts. The split isn’t needed to show the problem, Randolph said. “In my experience, people reuse passwords across personal and work accounts,” he said. “A personal credential in a breach is often a path to a work account.”

That makes an executive’s household part of the company’s cyber exposure. CINI’s Bitdefender piece made a similar point about attackers who log in rather than break in.

AI makes exposed data cheaper to use, Randolph said. He sees voice and video impersonation of executives and family members. He also sees AI-assembled dossiers built from scraped records and posts. Targeted phishing draws on personal details too. “AI reduces the cost of using exposed data,” he said. “It doesn’t create the exposure.”

Where Insurance Comes In

The survey didn’t ask about insurance. Its findings still touch on at least three kinds of cover:

• Corporate cyber. A reused executive password can open a work account. A cloned voice can push a fraudulent payment.
• Personal cyber. Policies sold to households respond to attacks on the family itself. On CINI’s podcast, Randolph called that cover a way to “get back to the point the second before the issue happened.”
• Kidnap and ransom. Thirty-two percent of CISOs and CSOs hear concerns about a family member being kidnapped. “The 32% is what the clients actually raise with us,” Randolph said. “It doesn’t measure incidents.”

Budgets are shifting as well, according to 360 Privacy’s survey. Fifty-nine percent of CISOs and CSOs said money for physical security is being diverted from the cyber budget. They tied it to recent high-profile incidents. Sixty-four percent said their organizations have merged digital and physical security or are doing so. That cyber money pays for controls underwriters ask about.

Attention Follows The Headlines

The concern is almost never about the plot, Randolph said. It is about access. Principals and spouses ask three questions, he said:

• “Can someone find our house?”
• “Can someone find where the kids are at 3 p.m.?”
• “Can someone get through to us via a person we trust?”

The trigger is almost always external. He listed a news story, a threat or doxxing post, and mail with an “odd or threatening” tone. A protest at the head office can do it. So can a family member’s post that goes viral.

Ninety-one percent of CISOs and CSOs say the security focus for the people they advise has become episodic. It rises after high-profile incidents and fades once the news passes. “It’s all about the headline, but the exposure was there prior to the headline,” Randolph said.

Reading The Numbers

Randolph was candid about the data’s limits. The monitoring figures cover every client who signed up for 360 Privacy’s service from June 2025 to June 2026. Some signed up proactively. Others came after an incident. “They don’t represent executives at large,” he said. 360 Privacy doesn’t disclose how many clients enrolled.

The survey reached 100 people in each of three groups. They were CISOs and CSOs, senior security and privacy executives, and family office wealth professionals. Each group carries a margin of error of 9.8 points. Small gaps between the groups may be noise.

The release led with executives who feel “untouchable.” Eighty-five percent of CISOs and CSOs agreed the people they advise often feel that way. The statement they rated ended “when in reality the opposite is true.” The question measured what advisers believe about their clients.

The AI finding also measures belief, Randolph said. Eighty-nine percent of CISOs and CSOs expect fully automated AI attack systems to be an existential threat within two years.

What Families Can Do

Randolph suggested five steps:

• Search each family member by name and city. Opt out of the top people-search sites.
• Lock down social accounts, including teenagers’ accounts. Turn off location tags and delay posting.
• Use unique passwords and turn on multifactor authentication for every account.
• Keep the home address out of new public records where the law allows. A trust, an LLC, or a PO box can help.
• Set a schedule to recheck.

The recheck matters because removal doesn’t last. Removed listings first came back in a median of 21 days. “That is why a one-time cleanup fails,” Randolph said. “Protection has to be continuous.”

Our Podcast

Trinity Davis and Chuck Randolph of 360 Privacy on why personal cyber insurance is now a necessity, not an extra. Get the episode here.

FAQ – Digital Exposure

What is digital exposure?

It is personal information about someone that others can find online. It includes home addresses, family names and leaked passwords on data broker and people-search sites.

How exposed are executives online?

At sign-up, the median 360 Privacy client had personal details on 121 sources and a home address on 112. Those clients don’t represent all executives.

How long does data removal last?

Removed information first reappeared in a median of 21 days, 360 Privacy says. Brokers re-ingest records from public sources and re-list them.

Can a family member’s account put a company at risk?

Yes. Chuck Randolph of 360 Privacy says people reuse passwords across personal and work accounts. A personal credential in a breach is often a path to a work account.

Which kinds of insurance does executive exposure affect?

Corporate cyber, personal cyber and kidnap and ransom cover. The 360 Privacy survey did not ask about insurance directly.

What can families do to reduce exposure?

Opt out of people-search sites, lock down social accounts, use unique passwords with MFA, keep the home address out of new public records, and recheck on a schedule.

Related Cyber Insurance Posts

• Firms Say They Limit Admin Rights. More Than A Third Still Hand Them Out, CyberFOX Data Shows.
• Move Fast Get Phished(Opens in a new browser tab)
• Family Office Cybersecurity: Deloitte Finds Most Family Firms Hit By Cyberattacks(Opens in a new browser tab)
• Urgent Wake-Up Call: 6 Shocking Stats About Family Office Cybersecurity in 2024(Opens in a new browser tab)
• Two-Thirds Of Cybersecurity Staff Consider Leaving Their Employer(Opens in a new browser tab)