I found it scarily easy to find info on some people. I was talking to my friend about it, so I tested it out on them (with their permission).
With just their public facing instagram account handle, I:
Found full name from family members in following list -> email, phone #, etc from full name
Found email + phone of most of the close family
Found address, PO box, and usernames from their past accounts
Found their (current!) password for email, social media, etc (but not bank) from a breach from 2016 (!!!)
Found their old wattpad account (!!!!!!)
Found out that their instagram had no 2fa and "hijacked it" with them next to me, changed email and password (not sure if they could have recovered it afterwards). Notifications did come through but given their email, I used an email newsletter spammer I made and a text spammer to blow up their phone to hopefully distract for the few minutes it took, to simulate a real attack.
Needless to say, it was bad news all around. (I already knew some of the info I found, but my search consisted of me pretending I didn't)
Edit: the irony of me posting about data security when I just divulged where I grew up & school district less than 2 weeks ago :'( (though I bet I'm fine given I have no other accounts with this username)
With just their public facing instagram account handle, I:
Found full name from family members in following list -> email, phone #, etc from full name
Found email + phone of most of the close family
Found address, PO box, and usernames from their past accounts
Found their (current!) password for email, social media, etc (but not bank) from a breach from 2016 (!!!)
Found their old wattpad account (!!!!!!)
Found out that their instagram had no 2fa and "hijacked it" with them next to me, changed email and password (not sure if they could have recovered it afterwards). Notifications did come through but given their email, I used an email newsletter spammer I made and a text spammer to blow up their phone to hopefully distract for the few minutes it took, to simulate a real attack.
Needless to say, it was bad news all around. (I already knew some of the info I found, but my search consisted of me pretending I didn't)
Edit: the irony of me posting about data security when I just divulged where I grew up & school district less than 2 weeks ago :'( (though I bet I'm fine given I have no other accounts with this username)