Why Publicly Available PII Is a Security Risk for Government 

Organizations spend heavily to control their attack surface. They patch endpoints, harden identities, monitor networks, deploy MFA, restrict privileged access, and continuously scan internet-facing infrastructure. 

However, the personal information of their employees that exists on the internet creates another attack surface. Home addresses, personal phone numbers, email addresses, relatives, previous addresses, employment history, property records, social media profiles, and other personally identifiable information (PII) are routinely aggregated by data brokers and people-search sites. Much of it can be found without compromising an agency’s system. 

Publicly exposed workforce information creates cyber, operational, and physical risk for government. Agencies should assess that exposure, prioritize high-risk roles, and consider continuous removal and monitoring as one component of a broader protection program.  

Public PII Has Become Part of the Attack Surface 

A successful social engineering attack starts with information. 

An attacker targeting a CISO, system administrator, help desk employee or other high-value employee can use publicly available data to construct a detailed profile before making contact. Personal email addresses and phone numbers provide alternate communication channels. Employment history and organizational relationships make phishing messages more convincing. Family information, property records, and home addresses can support impersonation, harassment, doxxing, swatting, or physical threats. 

Public-sector segment	Example situation	Risk created by exposed workforce information
Federal agencies	An attacker finds a federal help-desk employee’s personal phone number, relatives, and employment history, then uses those details to impersonate the employee during an account-recovery request.	Credential theft, unauthorized system access, and compromise of sensitive government information
State government	A threat actor identifies the home address and family members of a prosecutor, judge, election official, or child-welfare investigator.	Harassment, doxxing, intimidation, swatting, and physical threats affecting the employee and family
Local government	A criminal uses a municipal finance employee’s personal email, phone number, and reporting relationships to create a convincing payment-change request.	Business email compromise, fraudulent payments, and disruption of essential municipal services
Higher education	An attacker profiles a university administrator or researcher through people-search sites and uses personal details to craft a targeted phishing message involving a colleague or grant program.	Account takeover, research-data theft, financial fraud, and exposure of student or institutional records
Critical infrastructure	An adversary identifies the home address, personal contact information, and job responsibilities of an engineer or control-system administrator at a utility.	Targeted social engineering, coercion, physical surveillance, and potential disruption of essential services

Generative AI makes the problem more scalable. Information that previously required hours of manual open-source intelligence gathering can increasingly be aggregated, summarized, and incorporated into targeted attacks automatically. 

Traditional cybersecurity controls remain essential, but they address a different part of the problem. An EDR platform cannot remove an executive’s home address from a people-search site. MFA does not prevent an attacker from researching an employee’s relatives. A secure email gateway cannot stop someone from targeting an employee through a personal phone number. 

The objective of PII removal isn’t to make an individual invisible. That is neither practical nor necessary. It is to reduce the amount of reliable information available to someone attempting to target that individual or the organization that employs them. In security terms, it is attack-surface reduction. 

Daniel’s Law Shows Why PII Removal Matters 

Few examples demonstrate the consequences of exposed personal information more clearly than Daniel’s Law in New Jersey. 

Daniel’s Law was enacted following the July 2020 attack on U.S. District Judge Esther Salas’s family. The attacker located Judge Salas’s home address on the internet, went to the family’s residence, seriously wounded her husband, Mark Anderl, and killed their son, Daniel Anderl. New Jersey subsequently established protections restricting disclosure of home addresses for covered individuals, including judicial officers, prosecutors, law enforcement officers, certain child protective investigators, and qualifying family members. 

The law goes beyond restricting information on government websites. New Jersey provides a process through which an authorized person can request that a private person or entity cease disclosing protected home-address or unpublished telephone information online. 

Congress followed with the federal Daniel Anderl Judicial Security and Privacy Act of 2022, signed into law on December 23, 2022. Among its protections, the law restricts data brokers from knowingly selling, licensing, trading, transferring, or purchasing covered information concerning protected federal judges and their immediate families. It also establishes mechanisms for requesting removal of protected information posted online. 

Other states have continued to adopt similar protections. South Carolina, for example, implemented protections effective January 1, 2026, allowing eligible judges and law enforcement officers to request removal of certain personal contact information from publicly accessible state and local government websites. 

These laws are particularly relevant to government and judicial organizations, but the underlying security issue extends much further. Corporate executives, healthcare leaders, university administrators, financial personnel, attorneys, security teams, public-facing employees, and anyone with privileged access can face similar targeting. 

The regulatory movement toward protecting this information reflects a simple reality: readily available PII can create security risk. 

PII Removal Cannot Be a One-Time Project 

Removing a record once does not necessarily solve the problem. 

Data brokers continually obtain information from public records, commercial sources, online accounts, and other databases. Information removed today may later be republished or appear through another broker. 

That makes enterprise PII reduction an ongoing operational process: discover exposed information, submit removal requests, verify results, monitor for recurrence, and repeat the process when data reappears. 

Organizations can also take a risk-based approach rather than treating every employee identically. CISOs or high level staff are obvious candidates, but finance, payroll, HR, IT administrators, help desk personnel, and employees with access to sensitive systems can also warrant increased protection. 

The program can then be measured like other security initiatives: number of exposed records identified, successful removals, recurring exposures, coverage across high-risk populations, and changes in overall PII exposure. 

Where DeleteMe Fits 

This is where DeleteMe can become part of an enterprise security and privacy strategy. 

DeleteMe focuses on finding and removing personal information from data brokers and people-search sources and then continuing to monitor those sources for reappearance. For organizations, the objective is broader than personal privacy: reduce the information available to attackers targeting employees, executives, and other high-risk personnel. 

DeleteMe’s enterprise platform provides automated PII removal and recurring monitoring along with organizational reporting and administrative capabilities. Its Privacy Center gives administrators visibility into enrollment and removal activity, while enterprise onboarding can support capabilities such as SSO and SCIM provisioning.  

The platform covers more than 1,000 data brokers and sites worldwide and has completed more than 250 million removals. DeleteMe also supports government agencies and judicial organizations, including thousands of federal judges. 

The service has received notable third-party recognition as well. In June 2025, The New York Times’ Wirecutter published The Best Data Removal Services and selected DeleteMe as its top pick, following testing of multiple data-removal services. More recently, CNBC Select’s 2026 comparison named DeleteMe its choice for “best for in-depth removal.” 

PII removal does not replace identity security, endpoint protection, threat intelligence, security awareness, or physical security. It addresses a gap those technologies were not built to solve. Organizations have spent years reducing what attackers can learn about their systems. It is increasingly important to reduce what they can learn about the people who operate them. FRC can help evaluate and acquire DeleteMe’s capabilities for that purpose.