Published: July 8, 2026 | Last updated: July 8, 2026
TL;DR
- Dumpster diving is a social engineering attack where criminals search through trash to find sensitive information like passwords, financial records, and employee directories (University of Florida IT, 2026).
- Attackers look for discarded documents, old ID badges, shipping labels, hard drives, USB drives, and printed emails to use in phishing, impersonation, or credential theft (DMARC Report, 2026).
- Preventing dumpster diving requires a combination of policies and practices: shred sensitive documents, securely erase digital media, enforce clean desk policies, and train employees (CITO, 2024).
- Dumpster diving is often used as reconnaissance for larger attacks—it’s rarely the attack itself, but provides the ammunition for phishing, business email compromise (BEC), and identity theft (University of Florida IT, 2026).
- Related social engineering attacks include shoulder surfing (watching someone type), tailgating (following someone into a secure area), pretexting (creating a false scenario), and eavesdropping (intercepting communications) (MITRE CAPEC, 2026; TechTarget, 2024; Fortinet, 2026; Fortinet, 2026).
What Is Dumpster Diving in Cybersecurity?
Dumpster diving in cybersecurity refers to the act of searching through discarded materials—such as trash bins, recycling containers, or improperly disposed storage devices—to retrieve sensitive information (Twingate, 2024). Attackers look for documents, credentials, financial records, or hardware that may provide insight into a person or organization (Twingate, 2024). MITRE classifies it as an attack pattern where adversaries search discarded company information for useful intelligence (MITRE CAPEC, 2026).
Although the name suggests rummaging through physical dumpsters, the concept is broader. It includes retrieving unshredded documents, outdated hard drives, USB drives, printed internal reports, or even handwritten notes containing passwords (ExpressVPN, 2026). Attackers target anything that has been thrown away without proper destruction (ExpressVPN, 2026).
Dumpster diving is also known as “trashing” (Hexnode Blogs, 2026). Unlike hacking attempts that require technical skills, dumpster diving often requires nothing more than patience and access. It is a low-cost, low-risk entry point for attackers who want to gather intelligence before launching a more targeted cyberattack (ExpressVPN, 2026).
Why Dumpster Diving Still Poses a Threat in 2026
Many organizations invest heavily in cybersecurity technologies such as intrusion detection systems, endpoint protection, and email authentication standards. Yet physical security practices sometimes lag behind digital defenses (ExpressVPN, 2026). That gap creates opportunity. Dumpster diving remains effective because it exploits human oversight rather than software vulnerabilities (ExpressVPN, 2026).
Attackers rarely need a password immediately. Instead, they look for fragments: employee names, org charts, invoices, shipping labels, old badges, help desk notes, device serial numbers, Wi-Fi details, or printed emails (DMARC Report, 2026). Then, they use this context to make phishing, pretexting, business email compromise, or identity theft attempts more convincing (DMARC Report, 2026).
Dumpster diving can also be a source of competitive intelligence for corporate espionage, providing insights into a company’s plans, financial status, or client lists (Twingate, 2024). In the digital age, dumpster diving has evolved beyond physical trash bins to include digital waste. Cybercriminals now exploit discarded digital files, emails, and neglected storage devices to extract sensitive information (Saylor Academy, 2026).
Examples of Dumpster Diving Attacks
| Discarded Item | Potential Risk |
|---|---|
| Printed emails or invoices | Vendor impersonation, payment fraud (DMARC Report, 2026) |
| Old ID cards or badges | Physical access abuse (DMARC Report, 2026) |
| Shipping labels | Asset tracking and employee profiling (DMARC Report, 2026) |
| Hard drives or USB drives | Data theft (DMARC Report, 2026) |
| Help desk notes | Credential reset abuse (DMARC Report, 2026) |
| Device packaging | Endpoint targeting (DMARC Report, 2026) |
| Company phone books | Names and numbers of people to target and impersonate (Saylor Academy, 2026) |
| Organizational charts | People in positions of authority (Saylor Academy, 2026) |
| Memos | Small tidbits of useful information for creating authenticity (Saylor Academy, 2026) |
| Policy manuals | Shows how secure (or insecure) the company really is (Saylor Academy, 2026) |
| Calendars of meetings | Which employees are out of town (Saylor Academy, 2026) |
| System manuals, printouts, or login names and passwords | Exact keys to unlock the network (Saylor Academy, 2026) |
| Disks and tapes | Can be restored to provide useful information (Saylor Academy, 2026) |
Real-World Impact of Dumpster Diving
Dumpster diving may seem low-tech, yet it can lead to serious business consequences. Attackers often combine discarded information with phishing emails, impersonation attempts, or phone-based scams to increase credibility (University of Florida IT, 2026).
For example, an exposed shipping label, employee directory, or IT asset tag can help cybercriminals identify departments, vendors, or device types used within an organization (University of Florida IT, 2026). As a result, targeted attacks become more convincing and harder for employees to detect. Improperly discarded hard drives, USB devices, or printed records may expose confidential customer data, financial information, or internal credentials (University of Florida IT, 2026).
According to the FBI’s 2022 Internet Crime Report (IC3), 300,497 US-based victims reported phishing incidents in a single year, and Business Email Compromise (BEC) caused more than $2.7 billion in direct losses (ExpressVPN, 2026). These attacks are often fueled by information gathered through reconnaissance methods like dumpster diving.
How to Prevent Dumpster Diving Attacks
Preventing dumpster diving attacks requires a combination of best practices and technological solutions (Twingate, 2024). The most effective safeguards focus on what happens at the end of the information lifecycle, before paperwork or devices leave your control (CITO, 2024).
1. Shred Sensitive Documents. Before discarding any document containing sensitive information, use a cross-cut shredder to ensure it cannot be pieced back together (CITO, 2024). This is one of the most basic and effective defenses against dumpster diving (CITO, 2024).
2. Implement Secure Media Destruction. Properly erase digital files to prevent recovery. For hard drives, USB drives, and other storage media, use secure data erasure methods or physical destruction (CITO, 2024). Treat discarded devices as high-risk assets until IT securely wipes, retires, or destroys them (University of Florida IT, 2026).
3. Adopt a Clean Desk Policy. Encourage employees to keep their desks clear of sensitive documents at the end of the day (University of Florida IT, 2026). Locked disposal bins can also help prevent unauthorized access to discarded materials (University of Florida IT, 2026).
4. Establish a Clear Disposal Policy. Create and enforce a data retention and disposal policy that specifies how different types of information should be handled at the end of their lifecycle (ExpressVPN, 2026; Twingate, 2024).
5. Provide Employee Training. Educate staff on secure disposal methods and the risks associated with improper disposal (Twingate, 2024; Saylor Academy, 2026). Employees should understand that discarded information can be just as dangerous as data stolen through hacking.
6. Use Locked Disposal Bins. Secure trash containers can prevent unauthorized individuals from accessing discarded materials before they are collected for proper disposal (University of Florida IT, 2026).
7. Monitor and Audit Disposal Practices. Regularly review disposal procedures to ensure compliance and identify areas for improvement (Saylor Academy, 2026).
Shoulder Surfing: Watching Over Your Shoulder
Shoulder surfing is a form of physical data theft where an attacker steals sensitive information by observing a victim’s actions in public or semi-public spaces (MITRE CAPEC, 2026). In a shoulder surfing attack, an adversary observes an unaware individual’s keystrokes, screen content, or conversations with the goal of obtaining sensitive information (MITRE CAPEC, 2026).
Shoulder surfing is one of the simplest security threats because it uses observation instead of technical compromise (MITRE CAPEC, 2026). An attacker simply watches what another person types, reads, prints, or displays (MITRE CAPEC, 2026). Common targets include passwords, PINs, MFA codes, customer data, documents, or other confidential information (MITRE CAPEC, 2026).
Example: A traveler in an airport lounge logs into their bank account using their laptop. An attacker sitting nearby watches over their shoulder to capture the login credentials (MITRE CAPEC, 2026).
How to prevent shoulder surfing:
- Be mindful of your surroundings when discussing or viewing sensitive information in public areas (Hexnode Blogs, 2026)
- Use privacy screens on laptops and mobile devices
- Position yourself so that your screen is not visible to others
- Use biometric authentication where possible to reduce typing of sensitive information
Tailgating: Following Someone into a Secure Area
Tailgating, sometimes referred to as piggybacking, is a type of physical security breach in which an unauthorized person follows an authorized individual to enter secured premises while avoiding detection by an electronic or human access control system (TechTarget, 2024). It is one of the simplest forms of a social engineering attack, in which threat actors take advantage of human habits or weaknesses to perpetrate a malicious incident, such as a scam, theft, or a cyberattack (TechTarget, 2024; Bitdefender, 2025).
By simply following an authorized person, an unauthorized party can easily get around security mechanisms such as retina scanners, fingerprint scanners, and even human security guards, and gain access to restricted physical areas (Bitdefender, 2025).
Example: An attacker dressed as a delivery person carrying boxes approaches a secure entrance. An employee, being polite, holds the door open for them, allowing the attacker to enter the building without presenting a badge (TechTarget, 2024).
How to prevent tailgating:
- Don’t hold doors open in secure facilities (Bitdefender, 2025)
- Require every person to present their own badge for entry
- Install security cameras and access control systems
- Train employees to challenge strangers and report tailgating attempts
Pretexting: Creating a False Scenario
Pretexting is a form of social engineering tactic used by attackers to gain access to information, systems, or services by creating deceptive scenarios that increase the success rate of a future social engineering attack (Fortinet, 2026). During a pretexting attack, the adversary creates an invented scenario, assuming an identity or role to persuade a targeted victim to release information or perform some action (Fortinet, 2026).
Pretexting can serve as a precursor to larger cyberattacks, including business email compromise (BEC), ransomware deployment, or insider threat insertion (Fortinet, 2026). It is a scenario-based attack that exploits human decision-making rather than system flaws (Fortinet, 2026).
Example: An attacker calls a help desk, pretending to be an employee who has forgotten their password. They provide enough personal information (gathered from dumpster diving or other reconnaissance) to convince the help desk staff to reset the password (Fortinet, 2026).
How to prevent pretexting:
- Verify the identity of anyone requesting sensitive information
- Establish strict verification procedures for password resets
- Train employees to recognize and report suspicious requests
- Use multi-factor authentication to reduce the impact of stolen credentials
Piggybacking: Riding on Legitimate Access
In cybersecurity, piggybacking refers to an attacker gaining unauthorized access, either physically or digitally, by exploiting someone else’s legitimate access (Bitdefender, 2025). Piggybacking can lead to exposure of sensitive data, deployment of malware, account takeovers, or compromised systems and networks (Bitdefender, 2025).
Piggybacking is closely related to tailgating but can also occur in digital contexts. For example, an attacker may use someone’s unlocked computer after they step away to hijack their session and steal sensitive information (Bitdefender, 2025). Another example is connecting to your unprotected Wi-Fi network and monitoring your activity (Bitdefender, 2025).
How to prevent piggybacking:
- Enable auto-lock and session timeouts on all devices (Bitdefender, 2025)
- Secure Wi-Fi networks with strong passwords and encryption (Bitdefender, 2025)
- Use multi-factor authentication (MFA) (Bitdefender, 2025)
- Don’t hold doors open in secure facilities (Bitdefender, 2025)
Eavesdropping: Intercepting Communications
Eavesdropping in cybersecurity refers to the unauthorized interception and monitoring of traffic data over a network (Fortinet, 2026). An eavesdropping attack occurs when a hacker intercepts, deletes, or modifies data that is transmitted between two devices (Fortinet, 2026). Also known as sniffing or snooping, this process typically involves attackers exploiting unsecured or open network communications and unencrypted data, which enables them to access data in transit (Fortinet, 2026).
An excellent example of an eavesdropping attack is a Man-in-the-Middle (MitM) attack, where an assailant places themselves in the communication stream between two parties (Fortinet, 2026). Eavesdropping attacks can often be difficult to spot (Fortinet, 2026).
How to prevent eavesdropping:
- Use encryption for all sensitive communications
- Avoid using unsecured public Wi-Fi for sensitive transactions
- Use VPNs to encrypt network traffic
- Keep software and devices updated to patch security vulnerabilities
Comparison of Social Engineering Attacks
| Attack Type | Description | Method | Prevention |
|---|---|---|---|
| Dumpster Diving | Searching through trash for sensitive information (University of Florida IT, 2026) | Physical reconnaissance | Shred documents, secure disposal, clean desk policy (CITO, 2024) |
| Shoulder Surfing | Watching someone type or view sensitive information (MITRE CAPEC, 2026) | Observation | Privacy screens, be aware of surroundings (Hexnode Blogs, 2026) |
| Tailgating | Following someone into a secure area (TechTarget, 2024) | Physical access | Don’t hold doors, challenge strangers (Bitdefender, 2025) |
| Pretexting | Creating a false scenario to extract information (Fortinet, 2026) | Deception | Verify identity, establish verification procedures (Fortinet, 2026) |
| Piggybacking | Exploiting someone else’s legitimate access (Bitdefender, 2025) | Physical/digital | Auto-lock, MFA, secure networks (Bitdefender, 2025) |
| Eavesdropping | Intercepting communications (Fortinet, 2026) | Network interception | Encryption, VPNs, secure networks (Fortinet, 2026) |
Frequently Asked Questions
What is dumpster diving in cybersecurity?
Dumpster diving in cybersecurity is a social engineering technique where attackers search discarded trash, recycling bins, documents, labels, devices, or storage media to collect sensitive information that can support fraud, impersonation, or cyberattacks (University of Florida IT, 2026). MITRE classifies it as an attack pattern where adversaries search discarded company information for useful intelligence (MITRE CAPEC, 2026).
What are some examples of dumpster diving attacks?
Attackers look for discarded items like printed emails or invoices (which can lead to vendor impersonation or payment fraud), old ID cards or badges (physical access abuse), shipping labels (asset tracking and employee profiling), hard drives or USB drives (data theft), and help desk notes (credential reset abuse) (DMARC Report, 2026). They may also find company phone books, organizational charts, memos, policy manuals, calendars, system manuals, or login names and passwords (Saylor Academy, 2026).
How can organizations prevent dumpster diving attacks?
Organizations should implement a clean desk policy, use locked disposal bins, cross-cut shredding for sensitive documents, secure media destruction for digital storage, and provide staff awareness training (University of Florida IT, 2026). Establish a clear disposal policy and treat discarded devices as high-risk assets until they are securely wiped, retired, or destroyed (University of Florida IT, 2026).
What is shoulder surfing in cybersecurity?
Shoulder surfing is a form of physical data theft where an attacker steals sensitive information by observing a victim’s actions in public or semi-public spaces (MITRE CAPEC, 2026). The attacker watches what another person types, reads, prints, or displays, often over the victim’s shoulder (MITRE CAPEC, 2026). Common targets include passwords, PINs, MFA codes, customer data, documents, or other confidential information (MITRE CAPEC, 2026).
What is tailgating in cybersecurity?
Tailgating, also known as piggybacking, is a type of physical security breach in which an unauthorized person follows an authorized individual to enter secured premises while avoiding detection by an electronic or human access control system (TechTarget, 2024). It is one of the simplest forms of a social engineering attack (TechTarget, 2024; Bitdefender, 2025).
What is pretexting in cybersecurity?
Pretexting is a form of social engineering tactic used by attackers to gain access to information, systems, or services by creating deceptive scenarios that increase the success rate of a future social engineering attack (Fortinet, 2026). The attacker creates an invented scenario, assuming an identity or role to persuade a targeted victim to release information or perform some action (Fortinet, 2026).
What is eavesdropping in cybersecurity?
Eavesdropping in cybersecurity refers to the unauthorized interception and monitoring of traffic data over a network (Fortinet, 2026). An eavesdropping attack occurs when a hacker intercepts, deletes, or modifies data that is transmitted between two devices (Fortinet, 2026). A common example is a Man-in-the-Middle (MitM) attack, where an attacker places themselves in the communication stream between two parties (Fortinet, 2026).
Key Takeaways
- Dumpster diving is a social engineering attack where criminals search through trash to find sensitive information like passwords, financial records, and employee directories (University of Florida IT, 2026).
- Attackers look for discarded documents, old ID badges, shipping labels, hard drives, USB drives, and printed emails to use in phishing, impersonation, or credential theft (DMARC Report, 2026).
- Preventing dumpster diving requires a combination of policies and practices: shred sensitive documents, securely erase digital media, enforce clean desk policies, and train employees (CITO, 2024).
- Dumpster diving is often used as reconnaissance for larger attacks—it’s rarely the attack itself, but provides the ammunition for phishing, business email compromise (BEC), and identity theft (University of Florida IT, 2026).
- Related social engineering attacks include shoulder surfing (watching someone type), tailgating (following someone into a secure area), pretexting (creating a false scenario), and eavesdropping (intercepting communications) (MITRE CAPEC, 2026; TechTarget, 2024; Fortinet, 2026; Fortinet, 2026).
- Organizations must treat physical waste disposal as part of their overall cybersecurity and data protection strategy (University of Florida IT, 2026).