Case A: An attacker knows person A has account number 123. They also know that this person has a tablet, a phone and an Apple notebook that A always takes with

Case A: An attacker knows person A has account number 123. They also know that this person has a tablet, a phone and an Apple notebook that A always takes with them when leaving the home. A uses Twitter and a couple of other social networks that those devices sync with in regular intervals and syncs to iCloud (which can happen while the notebook is closed). I'd be surprised if this constant chatter isn't visible on the graphs. That means: The attacker can track rather well whether the person is at home or not. Or at least make informed guesses. They plan a robbery during a holiday. Or, much more malicious: some attack on the persons other web properties like their iCloud and Amazon account, as presented a while ago.[1] Case B: Consider that the attacker doesn't have the account number. Another leak in their platform allows them to link personal information with account numbers. In itself, that info is also not very interesting and would also not be "dangerous". Because the leak of the traffic graphs exists, they go on and plan the biggest heist in Toronto ever :). A good exploit is often the combination of multiple seemingly innocuous flaws. [1] is also a good example of that. [1]: http://www.emptyage.com/post/28679875595/yes-i-was-hacked-hard http://www.emptyage.com/post/28679875595/yes-i-was-hacked-ha...