Physical social engineering skips the screen entirely - as in the USB-borne Stuxnet sabotage of an Iranian nuclear site, the Yujing Zhang Mar-a-Lago intrusion, and the Procter and Gamble dumpster-diving espionage on Unilever - where tailgating into a building, dropping an infected USB drive, or posing as a contractor or guest gets past the front desk without ever touching an inbox. These 22 cases are sourced to court records, regulators, and federal settlements.
A Chinese national talked her way past three layers of Mar-a-Lago's Secret Service and club-staff checkpoints using a false pool visit and an unverified.
PSResearchers from UIUC, the University of Michigan, and Google dropped 297 USB drives across the UIUC campus and found that up to 98% were picked up.
PSA nation-state cyberweapon crossed an air gap into Iran's Natanz nuclear facility on infected USB drives carried in by trusted contractors.
PSTwo unencrypted TD Bank backup tapes carrying data on 260,000 customers vanished in transit between Massachusetts offices in 2012.
PSAdvance Machine Company's West Coast sales manager repeatedly rifled Tennant Company's sealed, covered dumpster in California to steal sales leads.
PSA Pennsylvania shredding-business owner's 2010 qui tam suit alleged that Shred-It, Iron Mountain.
PSTV investigative reporters filmed Rite Aid pharmacy dumpsters nationwide overflowing with readable prescription labels.
PSA widely circulated security-awareness case study (NINJIO) claims a tailgating "badge surfer" photographed passwords exposed by a clean-desk-policy.
PSA Rapid7 penetration tester tailgated into a client's building using door-holding reciprocity and a cloned-looking badge.
PSP&G-hired competitive-intelligence contractors retrieved roughly 80 unshredded confidential Unilever hair-care documents from the trash before P&G.
PSA Kansas City TV station found intact consumer home-loan applications with Social Security and account numbers tossed in a title company's open dumpster.
PSCalifornia's Attorney General and six county DAs found more than 10,000 paper patient records and hazardous/medical waste in unsecured.
PSBetween 2000 and 2009, GAO undercover investigators repeatedly used fake law-enforcement badges (and, in a related 2009 test.
PSDow Chemical and Sasol paid PR firms who subcontracted a private intelligence firm to run over 120 dumpster-diving raids on Greenpeace's DC offices.
PSFIN7 (Carbanak) mailed USPS packages disguised as Best Buy gift-card rewards containing BadUSB hardware implants to HR, IT.
PSDOJ unsealed indictments and won guilty pleas, prison terms, and multimillion-dollar restitution against FIN7 (Carbanak Group) members Fedir Hladyr.
PSCVS pharmacies nationwide tossed pill bottles, prescriptions, and employee SSNs into unsecured public dumpsters.
PSAn unrelated MHRA search warrant found care-home patient prescription and NHS records rotting in unlocked crates and bin bags at a London pharmacy.
PSOperation Buckshot Yankee: a malware-laden USB drive plugged into a U.S. military laptop in 2008 spread the agent.btz worm onto classified DoD networks.
PSAir Canada admitted in a sworn Ontario Superior Court affidavit that it hired private investigators who twice took trash from outside WestJet co-founder.
PSThe FTC's first-ever case under the FACTA Disposal Rule: a Northbrook, Illinois mortgage lender repeatedly dumped intact customer credit reports.
PSA Metropolitan Police officer spotted customers' passports and tax-credit paperwork clearly visible through transparent bin bags left on the street.
The Stuxnet USB-borne sabotage of an Iranian nuclear facility, the University of Illinois USB drive drop field experiment, Operation Buckshot Yankee infecting US Central Command networks, and FIN7 mailing BadUSB devices disguised as Best Buy gift cards all relied on someone plugging in a drive they should not have trusted.
Procter and Gamble pulled documents from a competitors trash in the Bad Hair Day case against Unilever, Greenpeace obtained internal memos from Dow Chemical and Sasol through the D-Lines operation, Air Canada accused WestJet of curbside garbage collection from a co-founder home, and Tennant Co. sued Advance Machine Co. over dumpster-sourced documents.
Rite Aid, CVS Caremark, and Kaiser Permanente each faced federal settlements after pharmacy or medical waste containing patient records turned up in the trash, TD Bank lost unencrypted backup tapes, Shred-It and Iron Mountain paid a 1.1 million dollar GSA settlement, and Doorstep Dispensaree drew the ICO first GDPR fine after patient records were found in an unsecured yard.
Yujing Zhang tailgated her way into Mar-a-Lago, Rapid7 blank-badge penetration testers walked through doors on reciprocity alone, GAO covert testers used fake law-enforcement badges to breach federal buildings including an IRS facility, and FIN7 operatives posed as legitimate businesses before their eventual DOJ prosecutions.
Social Engineering Examples