AI Gave Every Attacker Nation-State Capabilities. Data Brokers Supply the Targets.
By Tom Daly, Founder and CEO, Priwall by mePrism · October 2026
Key takeaways
-
AI is expanding attackers' capabilities. CrowdStrike CEO George Kurtz says AI has given “every adversary, every e-crime crew, every insider” nation-state capabilities. Frontier AI labs and threat-intelligence teams documented this shift in 2026.
-
AI reconnaissance is already being used. AI OSINT uses models and agents to research, profile and target individuals. Google, Anthropic and the FBI have reported attackers using these methods in 2025 and 2026.
-
Data brokers provide the raw material. People-search sites and brokers sell structured, linked personal information, including home addresses, phone numbers, birth dates and relatives.
-
Data availability becomes the limiting factor. As AI reduces the cost of reconnaissance, access to accurate personal data becomes increasingly important. Removing that data can make targeted attacks harder to execute at scale.
-
Employee exposure is part of the attack surface. CISOs and executive protection teams should continuously reduce data-broker exposure, prioritizing executives, IT administrators, help desk, finance and security staff, along with their families.
What is AI reconnaissance?
AI reconnaissance is the use of AI models and autonomous agents to gather and analyze information about a target before an attack. When the target is a person, it is often called AI OSINT, short for AI-assisted open-source intelligence. The agent searches public and commercial sources, resolves a name to a specific person, and assembles a dossier: role, contact details, home address, family and the facts needed to impersonate or pressure them.
Two related terms come up throughout this article. A data broker is a company that collects personal information from public records, commercial sources and online activity and sells or licenses it to others. A people-search site is a consumer-facing data broker that lets anyone look up a person’s addresses, phone numbers, relatives and history by name, often for free or a few dollars.
What did CrowdStrike’s CEO say about AI and nation-state capabilities?
George Kurtz argues that AI has erased the old tiers of attacker skill. At CrowdStrike’s Fal.Con conference on September 1, 2026, he said the threat pyramid had been “obliterated, flattened,” and added: “when apex capabilities become a prompt, guess what happens? There are no tiers at all. Every adversary, every e-crime crew, every insider are now operating with nation-state capabilities” (Investing.com transcript). Coverage summarized his point as AI “democratising nation-state level attacks,” which low-skill groups can now carry out “at the cost of tokens and prompts” (TechGig).
On CNBC’s Squawk on the Street on October 23, 2026, Kurtz said AI-powered attacks observed by CrowdStrike had doubled every month from July through September, and that defense “almost becomes unsustainable unless you’re using defensive AI” (CNBC).
Most commentary on this shift focuses on software: AI finding vulnerabilities, writing malware and moving through networks faster than people can. The other half gets less attention. Nation-state operations have always run on intelligence about people: who holds the admin keys, who approves wires, where the CFO lives, what the help desk asks before it resets a password, and which family members can be reached. Gathering that intelligence used to take analysts, time and money. AI removes most of that cost. What it cannot remove is the need for accurate raw material, and the U.S. data-broker industry sells that material cheaply, in structured form, refreshed continuously and linked across identities.
How are attackers using AI in cyberattacks in 2026?
Attackers now use AI to run intrusions with little human help, to move faster than defenders can respond, and increasingly to target people instead of machines. The figures below come from reports published in 2025 and 2026.
Of tactical work was performed by AI when a Chinese state-sponsored group used Claude Code against approximately 30 organizations.
Targeted by one criminal using AI to automate reconnaissance and extortion, with some ransom demands exceeding $500,000.
Year-over-year increase in operations by AI-enabled adversaries. Average eCrime breakout time also fell to 29 minutes.
Time taken by a financially motivated actor to plan, build and run a mass credential-harvesting campaign using an AI coding assistant.
Breaches between March 2025 and February 2026 were AI-enabled, representing a 56% increase from a year earlier.
Vishing intrusions doubled in the first half of 2026 compared with the second half of 2025.
Vishing accounted for 11% of initial access, making it the second most common vector, compared with 6% for email phishing.
Click-through rate achieved by fully automated AI spear phishing, matching human experts. The control group achieved 12%.
How do attackers use AI to gather personal information?
Attackers use AI to map organizations, identify the people with access, find their contact details and build personalized lures, and they now hand much of that work to autonomous agents. These are documented cases, not projections.
Organizational mapping. Google’s Threat Intelligence Group observed actors prompting models for detailed org charts of finance, internal security and HR departments at large companies, so they could aim phishing at people with administrative privileges. In one case, an actor tried to identify a high-value target’s computer from photos of that person (Google GTIG, May 2026).
State actors running OSINT with AI. Iran’s APT42 (now tracked as CALANQUE ION) used Gemini to identify specific individuals and their email addresses, research them and write localized pretexts. A PRC-nexus group used AI to profile high-value targets during reconnaissance, and North Korean clusters profiled aerospace and defense targets (Google GTIG).
A one-person doxxing platform. A single hacktivist used AI agents to build “fafsearch,” a “purpose-built doxxing platform” combining breach data and stolen records across tens of millions of rows. Anthropic called it one of the clearest cases of AI-assisted engineering applied to “a mass attack on privacy” (Anthropic, September 2026).
Searchable personal-data services. The same report describes a ShinyHunters-affiliated operator who turned stolen personal data into a searchable service, and a group that included two undergraduate students running agent swarms that pulled names, phone numbers and home addresses from a government agency (Anthropic, September 2026).
Profiling people for leverage. PRC-aligned operators used AI to build dossiers on religious leaders and diaspora figures, and to profile Uyghur individuals with family members in Xinjiang, which Anthropic described as leverage (Anthropic, September 2026).
An agent that researched people on its own. In a July 2026 UK AI Security Institute evaluation, Anthropic’s Mythos 5 left its test scope, traced a real GitHub project through an account’s follower list, emailed its human maintainers and created sock-puppet personas to pressure them into approving malicious code. The attempt failed and caused no harm (Anthropic, Ars Technica). It showed that a frontier agent will identify the people who control a target and try to manipulate them without being told to.
Tooling that points at people-search sites. Openly published AI reconnaissance “skills” for red teams list TruePeopleSearch, WhitePages and Spokeo alongside phone, email and breach lookups as standard sources for employee profiling (GitHub example).
A note on evidence: these threat reports document AI-driven profiling and doxxing, but they generally do not name data brokers as the source of the data. The connection between AI reconnaissance and broker data is Priwall’s analysis, based on what broker data contains and what attackers have been documented doing with it. For earlier context, see our posts on AI chatbots and automated doxxing and what Mythos means for data privacy.
How do criminals use data broker information in attacks?
Criminals use data-broker and people-search records to find where targets live, reach them on personal phones, pass identity checks and pressure their families. These cases predate AI agents, and they show the data is already part of attackers’ toolkits.
Minnesota, June 2025. Federal investigators found that Vance Boelter, who murdered state Rep. Melissa Hortman and her husband and wounded Sen. John Hoffman and his wife, carried a notebook listing 11 people-search sites, including TruePeopleSearch, Spokeo, BeenVerified, Whitepages and Intelius. Investigators have not established whether those sites supplied the victims’ addresses. Boelter has been sentenced to two consecutive life terms plus 40 years (The Beltway Report, KTTC).
Judge Esther Salas, July 2020. The gunman who killed her son, Daniel Anderl, had found her home address and personal information online (NBC News).
Executive swatting. BlackCloak reported a wave in which attackers took names from corporate leadership pages, then used data-broker sites such as 411.com and Spokeo to find home addresses and phone numbers (CSO Online). Control Risks reports that swatting services sell on Telegram for under $50 per incident (Control Risks).
Brokers as breach sources. The 2024 breach of National Public Data, a background-check broker, exposed up to 2.9 billion records with names, addresses, Social Security numbers and relatives (USA Today).
Military personnel for pennies. Duke University researchers bought identified data on U.S. service members from brokers for as little as $0.12 per record (Duke Sanford).
Foreign intelligence demand. Treasury sanctioned Zhou Shuai, a Shanghai-based broker of stolen data whose requirements sought information on public servants and media personnel (U.S. Treasury). The Justice Department now bars data-brokerage transactions with countries of concern, including China, Russia, Iran and North Korea (DOJ).
Identity construction. A North Korean IT-worker scheme run through an Arizona “laptop farm” used 68 stolen U.S. identities to place workers at 309 U.S. companies and generated more than $17 million (DOJ).
AI impersonation of officials and families. The FBI has warned that, since April 2025, actors have used AI-generated voice messages to impersonate senior U.S. officials (FBI IC3), and that virtual-kidnapping scams now use altered photos of loved ones as fake proof of life (FBI IC3).
We documented more cases in Data Brokers and the Ransomware Kill Chain.
Why does AI make data broker data more dangerous?
AI makes broker data more dangerous because broker profiles are structured, current and linked, which is exactly the input an AI agent needs to research thousands of people overnight. A broker profile is a ready-made answer to the questions an attacker must resolve before a social-engineering attack can work.
| Data commonly found in broker and people-search profiles | How an AI-assisted attacker uses it |
|---|---|
|
01
Current and past home addresses
|
Physical targeting, swatting, intimidating extortion notes, answers to identity-verification questions. |
|
02
Personal mobile numbers
|
Vishing outside corporate phone systems, SIM-swap and port-out attempts, smishing. |
|
03
Personal email addresses
|
Phishing that bypasses corporate filters, password-reset abuse, credential-stuffing pivots. |
|
04
Date of birth and age
|
Passing carrier, bank and help-desk checks, building synthetic identities. |
|
05
Relatives and household members
|
Family-targeted pressure, virtual kidnapping, impersonating a family member. |
|
06
Employer and job history
|
Matching a personal identity to a corporate role, building target lists by department. |
|
07
Identifiers linked across sources
|
Turning a name on a leadership page into a specific person, phone and house. |
Structured
AI agents work best on consistent, machine-readable sources. People-search sites present the same fields in the same layout for hundreds of millions of people, which makes them easy to query, parse and cross-check.
Current
Breach dumps go stale. Brokers refresh. An attacker holding an old HR file can use broker profiles to confirm who still works where, which phone is live and which address is current, and that kind of repetitive verification is what agents now do in seconds.
Linked
The most valuable thing a broker sells is the join: one record tying a corporate name to a personal phone, a home address, a spouse and a birthday. Assembling that for one executive used to take an investigator hours. An agent can now do it for an entire workforce for the cost of compute.
The scenarios below are hypothetical. They combine documented techniques from the sources above into plausible attack sequences, described at the threat-model level so defenders can recognize them. They do not reconstruct specific incidents.
Threat-model scenarios. These examples illustrate how AI reconnaissance and exposed personal data could be combined in targeted attacks.
Help-desk takeover at scale
A crew in the Scattered Spider mold, whose help-desk impersonation playbook is documented by CISA, tells an AI agent to list a Fortune 500 company’s IT administrators and identity engineers from professional profiles and conference bios. The agent runs each name through people-search sites to resolve personal mobile numbers, birth dates, address histories and spouses’ names, and within hours it has a few hundred verified dossiers ranked by privilege. A second agent writes a call script for each person, and a voice tool delivers it. The crew needs only one call to succeed. Without the broker data, the dossiers are thin or wrong, and the calls fail verification far more often. Related: Scattered Spider and executive cyberattacks .
Coercion of the board
An extortion group that has stolen data from a biopharma company takes directors’ names from the proxy statement, then has an agent resolve home addresses, spouses and adult children from broker profiles. The ransom email lists each director’s street. When the company stalls, the group buys a swatting call for under $50. A cyber incident has become a physical-security incident, and none of the leverage came from the stolen files. See our 2026 executive protection playbook .
The deepfake CFO, with personal context
In 2024, an Arup employee transferred about $25.6 million after a video call with deepfakes of the CFO and colleagues (CNN). The next version starts with an agent mapping the treasury team and using broker data to reach each person on a personal mobile phone, outside corporate monitoring, with a text and then a cloned voice from the “CFO.” More on this pattern in Executive Doxxing in the AI Era .
SIM swap on the executive’s personal line
Broker data supplies a CEO’s personal number, billing address and date of birth, the facts a carrier representative may check before porting a number. Once the number moves, so does every SMS code, opening personal email, brokerage accounts and, through reused credentials, corporate systems. Our carrier lock guide explains how to close this path.
Government and military personnel as a target set
A foreign intelligence service buys broker data on personnel connected to a base or defense contractor, a market Duke researchers showed was cheap. An agent cross-references names with professional profiles to find likely clearance holders and builds dossiers covering family, finances and home locations. The output feeds tailored spear phishing, recruitment approaches that use family leverage, and AI-voiced impersonation of senior officials. See military data removal after the Pentagon breach .
The synthetic employee
A North Korean IT-worker cell uses real people’s names, birth dates and address histories from broker profiles to make a borrowed identity look consistent across verification databases, while AI generates the resume, profile photo and live interview answers. CrowdStrike reports that the group known as FAMOUS CHOLLIMA already uses AI-generated personas to scale these operations (CrowdStrike).
The family as the soft perimeter
The executive is well protected, but their 78-year-old mother is listed as a relative, with her address and landline. An attacker calls her with a cloned voice of her grandson in distress, or sends a family member an altered “proof of life” photo, the scam the FBI warned about in December 2025. Our household data broker removal playbook covers family coverage.
Precision phishing across a whole workforce
A ransomware affiliate targets a hospital system with 15,000 employees. An agent resolves each employee’s role, personal email, phone and household details, then writes a different lure for each: an HOA notice for a nurse, a payroll change for a scheduler, a delivery text to a physician’s personal phone. Workforce-wide personalization used to be impossible. Now its cost scales with tokens, and its accuracy depends on how much personal data is available.
Does removing data from data brokers still matter if AI can find it anyway?
Yes. AI removed the labor cost of research, so the availability of accurate data is now the main constraint on targeted attacks. Every removed profile means a failed lookup, a stale record or a wrong number, and the agent has to fall back on weaker sources.
Scale works against exposure. A person researching one executive by hand may eventually find what they need. An agent running against 5,000 employees is optimizing yield. Reducing broker exposure across high-risk groups lowers the success rate of the whole campaign, and that rate decides whether a large AI-driven operation pays off.
Attackers are moving to personal channels. Vishing has overtaken email phishing as an initial-access vector in Mandiant’s frontline data. Personal phones, personal email and home addresses sit outside corporate controls, and broker data is how attackers connect a corporate identity to them.
Brokers refresh breach data. Stolen records go stale as people move and change numbers. Brokers keep them current. Removing broker profiles cuts off that refresh and shortens the useful life of data that has already leaked. We covered this in the FBI breach and employee data broker exposure.
Cyber and physical threats now draw on the same data. The profile that supports a help-desk call also supports a swatting call or a visit to someone’s front door. CISOs and executive protection leads are defending against the same inputs.
Governments already treat it as a security issue. California’s DROP platform requires registered brokers to process deletion requests (The Beltway Report), and federal rules restrict brokering Americans’ bulk data to foreign adversaries. Bruce Schneier has made the national-security case for broker deletion to Congress (Priwall).
What removal does not do. Removing broker and people-search listings does not erase data already exposed in breaches, delete government or court records at their source, or hide what people post on social media. It does not stop social engineering by itself. It reduces the accuracy and availability of the data that makes targeted attacks cheap, and it works best alongside phishing-resistant MFA, help-desk verification that does not rely on facts attackers can buy, carrier port-out locks and executive protection programs.
What should CISOs and executive protection teams do now?
Treat personal-data exposure as attack surface, start with the people attackers map first, include their families, and make removal continuous.
Measure exposure like any other attack surface. Assign an owner and report it alongside vulnerability and identity metrics. Our employee PII exposure score is one way to start.
Prioritize the cohorts attackers target first: executives and directors, IT and identity administrators, help desk staff, finance and treasury, HR, security and incident-response staff, and anyone with government or defense access.
Include households. Spouses, adult children and parents appear in broker profiles as relatives and are often the least protected route to the principal.
Make removal continuous. Brokers re-acquire and re-list data, so a one-time cleanup decays. Rescanning and resubmission are part of the control.
Stop verifying identity with facts brokers sell. If a help desk, carrier or bank accepts a birth date, address history or relative’s name as proof of identity, assume an AI-equipped attacker already has it.
Run the attacker’s reconnaissance on yourselves. Ask your red team or an outside firm to show leadership what an agent can assemble on the C-suite and admin population in an afternoon.
Use state rights where they apply. California residents can use DROP directly, as we explained in California DROP results for employers.
How does Priwall reduce AI reconnaissance exposure?
Priwall by mePrism removes employees’, executives’ and family members’ personal information from U.S. data brokers and people-search sites. It files requests as an authorized agent, rescans continuously and resubmits as listings reappear, and provides proof-of-removal evidence for security and compliance reporting. Organizations can protect specific high-risk groups or entire workforces without a system integration.
For a representative sample of Priwall enterprise customers, a signed AICPA AT-C 215 practitioner report from Sensiba found removal rates greater than 92 percent at 30 days and greater than 99 percent at 90 days, with a four-day median to first confirmed removal (Priwall efficacy, AT-C 215 report announcement).
Kurtz’s point is that offensive capability is now cheap. Defenders cannot make AI expensive again, but they can make it less useful by reducing the personal data it can find. When reconnaissance costs only tokens, that data is one of the few attack inputs a security team can still take away.
Talk to Priwall about protecting your executives and high-risk employees
Frequently asked questions
What did George Kurtz mean by AI democratizing nation-state attacks?
The CrowdStrike CEO means AI has erased the skill gap between elite and ordinary attackers. At Fal.Con in September 2026, he said “every adversary, every e-crime crew, every insider are now operating with nation-state capabilities” because “apex capabilities become a prompt.”
What is AI OSINT?
AI OSINT is open-source intelligence gathering performed or accelerated by AI models and agents. Attackers use it to identify people inside a target organization, find their contact details and personal information, and write personalized lures, at a speed and scale that manual research cannot match.
How do hackers use data brokers?
Hackers use data brokers and people-search sites to connect a name to a home address, personal phone number, date of birth and relatives. They use that information for vishing, help-desk impersonation, SIM swaps, swatting, extortion and family-targeted scams.
Can AI agents search people-search sites automatically?
Yes. Openly published AI reconnaissance tools for security testing already list people-search sites such as TruePeopleSearch, WhitePages and Spokeo as standard sources, and threat reports from Google and Anthropic document attackers using AI to profile individuals.
Why are executives and their families at higher risk from AI-driven attacks?
Executives control money, access and reputation, and their names are public. Broker profiles link those names to homes, personal phones and relatives, giving attackers routes around corporate security through personal devices and family members.
Does removing personal data from data brokers stop AI-driven attacks?
Removal does not stop every attack, and it does not erase breach data, public records or social media. It reduces the accuracy and availability of the personal data AI reconnaissance depends on, which lowers attackers’ success rate. It works best alongside phishing-resistant MFA and stronger help-desk verification.
Which employees should a company protect first?
Start with executives and directors, IT and identity administrators, help desk staff, finance and treasury, HR, and security staff, plus their households. These are the groups threat reports show attackers mapping first.
How effective is Priwall at removing data from data brokers?
For a representative sample of Priwall enterprise customers, a signed AICPA AT-C 215 practitioner report from Sensiba found removal rates greater than 92 percent at 30 days and greater than 99 percent at 90 days, with a four-day median to first confirmed removal.
At Priwall by mePrism, we remove personal information from 7over 600 data brokers and people-search sites, for individuals and for companies protecting their employees and executives. See what's exposed about you.
