Physical social engineering cases from this library, from the USB drives behind Stuxnet to rivals going through each other's rubbish. For each one: how they got in, what it cost, and what would have stopped it.
Physical social engineering is getting past people in the real world rather than through an inbox. Walking in behind someone with a badge (tailgating), dropping an infected USB stick in the car park (baiting), or going through a company's rubbish for paperwork (dumpster diving). No firewall sees any of it.
Key takeaways
Following an employee through a secure door, or walking in as a contractor, delivery driver or new hire. In a 2018 test, a Rapid7 penetration tester got into a client's building by having doors held for him, rode the lift on a bystander's badge, then posed as a new security-team hire at the help desk. Between 2000 and 2009, US government auditors with counterfeit law enforcement badges were waved around screening at all 21 sites they tried in one test.
Leaving an infected device for someone to plug in. More on the USB drop attack page.
Going through rubbish for documents. It sounds old-fashioned, but it's how a lot of real data walks out the door, and regulators have fined companies for it.
| Case | Method | What happened |
|---|---|---|
| Stuxnet, 2010 | Infected USB drives | Crossed the air gap at Natanz; about 1,000 uranium centrifuges destroyed |
| Buckshot Yankee, 2008 | An infected flash drive | A worm on classified US military networks and a 14-month cleanup |
| Mar-a-Lago, 2019 | A pool-visit story and an unchecked assumption | She got in; agents found four phones and a USB drive on her |
| UIUC experiment, 2015 | 297 dropped USB drives | Up to 98% picked up, 45% plugged in and opened |
| P&G and Unilever, 2001 | Contractors going through a rival's rubbish | P&G self-disclosed, fired three employees and settled with Unilever |
| CVS, 2009 | Prescriptions and staff data in public dumpsters | A $2.25 million HHS settlement and an FTC consent order |
| Kaiser Permanente, 2023 | Patient records in unsecured bins | The California AG and six county DAs found more than 10,000 paper records |
| FIN7, 2020 | Malicious USB devices sent by post | Sent to HR, IT and executives, built to install malware the moment one was plugged in |
In 2019 a Chinese national got into Mar-a-Lago after telling staff she was there to use the pool, and staff assumed, without checking, that she was related to a member. Secret Service agents found four phones and a USB drive on her. The lesson is the same as most building cases: an assumption was allowed to stand in for a check. Full case: Mar-a-Lago intrusion.
Tip: if you're not sure someone should be in the building, offering to walk them to reception is polite and safe. A real visitor won't mind.
Related pages: USB drop attack, baiting vs phishing.
Tricking people in person, or through physical objects, to get access to buildings, devices or information. Tailgating, USB baiting and dumpster diving are the most common forms.
Following an authorised person through a secure door without using your own badge. It works because most people don't want to be rude.
It depends where and what's taken, and this isn't legal advice. Companies that throw away personal data carelessly can be fined, as CVS and Kaiser Permanente were.
By hiring penetration testers to try to get in, like the Rapid7 test in this library, and fixing whatever let them through.
Reviewed by the SEE Team on 23 October 2026; every case linked here has its sources on its own page.
Social Engineering Examples