Dumpster-Diving Attack

❗Article Status Notice: This Article is a stub

---

This article is underdeveloped, and needs additional work to meet the wiki's Content Guidelines and be in line with our Mission Statement for comprehensive coverage of consumer protection issues. Learn more ▼

Issues may include:

• This article needs to be expanded to provide meaningful information
• This article requires additional verifiable evidence to demonstrate systemic impact
• More documentation is needed to establish how this reflects broader consumer protection concerns
• The connection between individual incidents and company-wide practices needs to be better established
• The article is simply too short, and lacks sufficient content

How you can help:

• Add documented examples with verifiable sources
• Provide evidence of similar incidents affecting other consumers
• Include relevant company policies or communications that demonstrate systemic practices
• Link to credible reporting that covers these issues
• Flesh out the article with relevant information

This notice will be removed once the article is sufficiently developed. Once you believe the article is ready to have its notice removed, visit the Discord (join here) and post to the #appeals channel, or mention its status on the article's talk page.

A dumpster-diving attack is an attack where a malicious actor collects disposed-of sensitive data, commonly in the form of storage devices. The target of this type of attack can be a large business or an individual.

How it works

Due to how most storage devices work, files that are deleted by the user are not immediately deleted; instead, they are marked as available to be overwritten. This allows deleted files on disposed storage devices to be recovered using data recovery tools.

This attack is not limited to storage devices; paper records can also be used to extract sensitive information.

Why it is a problem

Malicious actors can use this technique to recover the sensitive data of both individuals and companies alike. They can then use this data in numerous ways, including selling to data brokers<nowiki>, performing fraud, etc. Often, the sensitive data gained from companies is the personal information of its consumers.

In an attempt to protect against this, many companies shred their storage devices when they are done with them. The problem with this is that it generates a high amount of waste. Additionally, a skilled actor could still recover the data from a shredded storage device.