Very Attacked Persons are people whose digital and physical identities face unusually high exposure to targeted cyber, fraud, or harassment attempts. In identity security, the label describes individuals needing stronger monitoring, verification, and protection because their roles, influence, or access make them more attractive targets for credential theft and impersonation.
How Very Attacked Persons Are Different
very attacked person are not defined by a technology stack or a role title alone. The label identifies a person whose digital and physical identity is more likely than average to be singled out for phishing, impersonation, account takeover, extortion, doxxing, or harassment because of public visibility, authority, wealth, access, or controversy.
That matters because the attacker’s target is the person as an identity surface, not just the accounts they hold. A single compromise attempt can combine social engineering, leaked personal data, and device or session theft into one campaign that crosses both cyber and physical risk.
Why This Term Matters in Identity Security
In identity security, the key issue is exposure. A very attacked person often faces a wider attack surface across email, messaging, social media, password resets, MFA recovery, and trusted assistants or family members who can be manipulated into helping an attacker.
This also means ordinary assurance is often not enough. For high-risk individuals, the security bar shifts toward stronger proofing, tighter recovery controls, better monitoring for impersonation, and more deliberate separation between public presence and sensitive identity recovery paths.
The term is useful because it focuses attention on targeting intensity, not just privilege level. Some people are attacked because they are powerful, while others are attacked because they are prominent, politically exposed, financially attractive, or simply easy to impersonate at scale.
Common Attack Paths Against Very Attacked Persons
The most common pattern is identity abuse. Attackers try to steal passwords, intercept one-time codes, hijack sessions, reset accounts through help desks, or exploit weak recovery questions and contact channels to impersonate the person or gain access to their services.
Harassment and extortion are also part of the threat model. A campaign may begin with inbox compromise or social account takeover, then expand into blackmail, reputational damage, misinformation, SIM swapping, or the disclosure of private photos, messages, travel plans, or location data.
Because the target is often well known, the attacker can use highly tailored lures that look more credible than generic spam. Public biographies, corporate org charts, press releases, and social posts all give adversaries material to craft convincing pretexts.
Protection Strategies for Highly Targeted Individuals
Protection starts with reducing unnecessary exposure. The strongest approach is to narrow what is public, harden recovery channels, and treat identity recovery as a high-value control surface rather than a convenience feature.
Monitoring should cover both accounts and impersonation attempts. That includes alerts for new logins, password reset activity, suspicious SIM changes, lookalike domains, fake profiles, and unusual requests made to assistants, support teams, or trusted contacts.
For individuals with a high public or operational profile, security teams often separate personal and professional identity paths, reduce shared dependency on a single recovery phone number, and apply stronger verification to any request that could expose credentials, sessions, or location-sensitive information.
Risk and Threat Considerations
Very attacked persons carry a concentrated compromise risk because a successful social-engineering event can unlock many downstream systems at once. The same exposure that makes them visible also makes them easier to profile, pretext, and impersonate.
Failure mechanism: Attackers exploit public information, weak recovery processes, and human trust to bypass normal account protections, then use stolen sessions, reset access, or impersonation to extend the compromise into other services and contacts.
Impact: The result can include account takeover, private data exposure, financial fraud, reputational harm, unsafe physical disclosure, or secondary attacks against organisations and people connected to the target.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 provides the primary governance reference for this term.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | High-value targets need stronger user authentication to resist impersonation and takeover. |
| IA-5 — Authenticator Management | The term centers on protecting credentials, reset paths, and authenticator lifecycle. | |
| IR-6 — Incident Reporting | Very attacked persons need rapid escalation when impersonation or takeover is suspected. | |
| Recommendation — Require strong user authentication for high-risk accounts and recovery workflows. Tighten authenticator issuance, rotation, and revocation for exposed individuals. Enable fast reporting and escalation for suspected impersonation or account abuse. | ||
Practitioner Guidance
Why practitioners should care: The right response is not just stronger passwords, but stronger identity containment around the person. For very attacked persons, the security design must assume that an attacker will actively probe recovery, support, and social trust paths.
What to watch for: Repeated reset requests, suspicious device enrolment, unexpected contact changes, fake support outreach, and signs that third parties are being used as a shortcut into the target’s accounts are often the earliest warning indicators.
Practitioner takeaway: Treat the person’s recovery journey, not only the account, as the primary control boundary.