How you’re exposed

Sites like 192.com that turn your name into your address, phone and relatives.

Firms that quietly compile and sell a file on you - and your UK rights to stop them.

The version of the electoral roll that is sold to anyone - and the free opt-out.

A company director’s home address, left showing on a public filing.

Who owns the house is public - what you can and cannot do about it.

Cookies, pixels and fingerprinting that follow you from site to site.

A single ID that ties your whole day across apps to an advertiser’s profile.

A free game or weather app quietly selling your location and contacts.

Newsletters and senders that record when, where and how often you open.

Clubcard points bought with a detailed record of what you buy.

Websites that record what you type - even the fields you abandon.

A fake message that persuades you to click, sign in or pay.

Phishing written for you alone, using details that make it ring true.

A criminal poses as your boss or a supplier to have money sent to them.

A convincing invoice carrying the criminal’s bank details.

“It’s the boss. I need this done quickly, and quietly.”

The same trick by text message - fake deliveries, fines, banks.

A convincing phone call claiming to be your bank, or “support”.

A tampered QR code that sends you to a fake site.

Cloned voices and faces used to impersonate real people.

A long confidence trick that builds trust, then takes your savings.

Fake jobs that harvest your details, or charge you up front.

“Your computer has a virus” - from someone you never contacted.

One password, used everywhere - the attacker’s master key.

Stolen password lists tried automatically against your logins.

Being flooded with approval prompts until you tap “yes”.

A criminal hijacks your phone number to catch your codes.

Stealing the “already signed in” token to skip your password.

Someone gets into your account and shuts you out.

Quiet software that lifts your saved passwords and session cookies.

A “useful” program that quietly hands over control.

Software or hardware that records every key you press.

Poisoned adverts that attack you simply for loading a page.

Your devices quietly mining cryptocurrency for someone else.

Harmful apps and fake “updates” on your phone.

The one device that logs where you go, who’s near you, and what you photograph.

Modern cars log where you drive, how you drive, and whom you pair.

Always-listening devices, and TVs that watch what you watch.

Your camera films the neighbours; theirs films you.

Your broadband and mobile provider can see every site you connect to.

Your phone and cloud quietly building a face index of your life.

Fake hotspots and open networks that watch your traffic.

Someone quietly sitting between you and the site you are using.

A laptop or phone goes missing - with everything on it.

Watching eyes reading your screen, or your keystrokes.

Email, chat, keystrokes, webcam and location - tracked as “productivity”.

A child’s whole day on a Chromebook the school can read.

Classroom apps whose privacy policy is really a commercial licence.

Screening firms that never forget an old address or a closed matter.

A discount for a box that reports how you drive - or how you sleep.

Right-to-work, right-to-rent and age checks - each a fresh copy of your ID.

Your private details published to intimidate, or to endanger you.

Old posts, tags by other people, and photos that never really go away.

One friend installing an app can hand over your number and details.

Your posts, photos and messages used to train the platform’s AI.

Even encrypted chat shows who you talked to, and when.

Political, health and personal guesses drawn from what you pause on.

Period, fertility, mental-health and symptom apps holding your most private data.

Your face, voice and fingerprints, taken and kept longer than the moment needs.

Health data “de-identified”, then re-linked, and shared or sold on.

What the law lets the state collect - the backdrop to everything else.

Live and retrospective face-matching against public and police cameras.

At the border, officers can ask to examine your phone and laptop.

Number-plate cameras recording where your car goes, kept for years.

People reaching data or actions they should never be allowed.

Hostile input your app or database runs as instructions.

Malicious scripts planted in your pages, run by your visitors.

Doors left open: default passwords, exposed panels, missing settings.

A trusted supplier or code library is compromised - and so are you.

Passwords and keys left, by accident, in code or in the open.

The behind-the-scenes connections between apps, left under-guarded.

Tricking your own server into fetching what it should not.

Known holes left unfixed - the attacker’s preferred shortcut.

Remote sign-in doors left open to the whole internet.

Your files locked and scrambled until you pay - perhaps.

Flooding your site with traffic until it falls over.

Your web address pointed at the attacker’s server - or taken outright.

Files meant to be private, quietly left open to the world.

Sensitive information slipping out through everyday mistakes.

Staff using apps and services no one has checked or approved.

Your data exposed because a supplier was breached.

Harm from someone on the inside - careless or deliberate.

Someone walking in behind you through a locked door.

A “lost” memory stick, left for a curious person to plug in.

Hidden instructions that hijack what an AI assistant does.