US single-family office establishes a household exposure baseline as part of a cyber advisor onboarding.

An American single-family office engaged LeakTrace as part of a broader cyber advisor onboarding process. The engagement established the household exposure baseline the office and its outside advisors would maintain against, and shaped the standing security program the office implemented.

Engagement origin

The office serves a single ultra-high net worth principal family with staff managing investment operations, tax planning, philanthropic affairs, and administrative concierge functions. The office had recently onboarded a cyber advisor firm to serve as ongoing external cyber counsel, and the cyber advisor had identified a foundational documentation gap: no baseline exposure audit existed against which subsequent monitoring could be calibrated. LeakTrace was referred by the cyber advisor as an independent third party specifically for the baseline function, avoiding the cyber advisor's own audit-and-remediate conflict of interest.

Discovery scope

LeakTrace conducted a household-level external attack surface audit covering the principal family's personal email exposure, residential and asset property records, family member social media presence, professional and philanthropic affiliations, and household staff footprint. The engagement did not touch the office's internal systems or any principal's personal devices; it evaluated only public and monitored sources.

Findings summary

• Personal email exposure across family members. All principal family members had at least one email address in monitored breach databases. Reuse patterns extended into consumer service accounts in a subset of cases, and into philanthropic board correspondence for the primary principal.
• Property record exposure. Multi-jurisdictional property records disclosed the family's residential and asset footprint at a level of detail that permitted physical mapping. Trust entity structures had reduced but not eliminated cross-referenceability.
• Family member professional exposure. Adult family members with professional identities had public workplace directories disclosing employer, role, and contact patterns. The disclosure was standard for their professional contexts but was directly usable in pretext construction against the office.
• Household staff social footprint. Personal social media of household staff disclosed principal family movement patterns in a subset of cases. The office's existing employment agreements did not include personal social media guidance for staff.
• Philanthropic disclosure aggregation. Combined philanthropic disclosures across the principal family's supported organizations produced an aggregate financial picture that a hostile actor could excerpt selectively.

Office actions

The office implemented a phased remediation program in coordination with the newly-onboarded cyber advisor. Personal email exposure was addressed at the individual family member level. Family member professional disclosures were reviewed with each family member's employer. Household staff onboarding was revised to include a social media protocol, with existing staff briefed on the revised protocol. Philanthropic disclosure practices were reviewed with the supported organizations. The cyber advisor established ongoing monitoring against the baseline.

Outcome

The office's standing security program operates against the LeakTrace baseline, with the cyber advisor conducting continuous monitoring and coordinating remediation. Documented inbound pretext attempts against the office's administrative staff have declined materially in the twelve months following remediation. The office retained LeakTrace for annual baseline refresh, with the cyber advisor as the day-to-day operational partner.