BLOG

By David Chernitzky, CEO, Armour Cybersecurity  ·  Serving private clients and family offices across North America  ·  Last updated August 21, 2026

Key Takeaways

• Family members are targeted because their connection to the principal gives attackers indirect access. Compromising an adult child’s email may surface family financial correspondence, attorney communications, or real estate details. Convincing a spouse to click a malicious link may open shared cloud accounts or family communication channels. The target is the relationship, not the family member’s own data.
• Household staff hold more sensitive access than most principals realize. Personal assistants manage calendars, travel, property access, and correspondence. Household managers may hold residence security codes, keys and property records, and contractor relationships, including who enters the home. That access, granted out of operational necessity, makes them high-value social engineering targets.
• Credential reuse is the most common vulnerability across family and staff accounts. Reusing one password means a breach of any one service potentially exposes every account using it. An attacker targeting a specific household runs the email addresses they can identify against known breach databases; the credentials that surface become the starting point for account takeover everywhere the same password was used.
• Age-appropriate security is possible for every family member. Controls that fit a 55-year-old principal do not fit a 14-year-old child or a 75-year-old parent. Children need parental controls and safe-online guidance. Elderly parents need simple authentication, clear recovery, and protection against scams targeting older adults. Household staff need practical credential tools and clear guidance on what to share and what not to.
• The household staff security risk extends to former employees. A household manager who left a year ago may still know the gate codes, the security system PIN, the family’s travel patterns, and the attorney’s email. If their digital access was not revoked promptly, they may retain logins to household services, property platforms, or shared channels. The corporate offboarding principle applies: access must be revoked completely and promptly when employment ends.

How Attackers Exploit Family and Staff Connections

Targeted phishing using family intelligence

Attackers preparing to target a high-net-worth family gather publicly available information first. Family members’ social media profiles provide names, relationships, school affiliations, travel patterns, and the kind of personal detail that makes a phishing message convincing. A message to the principal that references the family’s vacation location, a family member’s school, or a recent family event is not based on insider knowledge. It is based on publicly posted content any attacker can find in minutes.

That information then enables attacks against other family members. An attacker who has profiled the family can send the principal’s adult child a message that appears to come from a family friend, a school administrator, or a service the family uses, referencing specific true details to establish credibility. The goal may be credentials, malware on the child’s device, or using the child’s account to send a more credible message to the principal. The chain that starts with a family member’s social media post and ends with the principal’s financial account is well established; the links just need to be closed.

Social engineering of household staff

Household staff are a particularly effective target because their job requires them to be helpful and responsive to requests from people associated with the family. An attacker who calls a personal assistant posing as the principal’s attorney, private banker, or a service provider the family uses, referencing the correct names and details, can often obtain sensitive information simply by asking. The assistant whose job is to facilitate access and manage logistics is not conditioned to interrogate every request; they are conditioned to help.

Business email compromise is common in the HNWI context. An attacker who has compromised a family or staff member’s email can impersonate that person to redirect wire transfers, obtain sensitive documents, or gather information for further attacks. The household manager who receives a message that appears to come from the principal asking for the gate code to be shared with a contractor, sent from what looks like the principal’s address but is spoofed or compromised, faces an attack that awareness training alone does not prevent. Process controls that require verbal confirmation for sensitive requests, combined with dark web and credential monitoring that surfaces exposed staff credentials before they are used, are the appropriate defense.

Building Security for Every Person in the Household

Family digital safety in practice

An effective program begins with an assessment of each in-scope family member: age and technology comfort, the devices they use, the accounts they hold, what sensitive family information flows through their communications, and any measures already in place. The assessment identifies specific gaps for each person rather than applying one approach that works for some and is ignored by others.

For each family member, the program establishes device security appropriate to their age and usage, unique strong passwords for every account managed through a family password manager with secure sharing where appropriate, multi-factor authentication for every account that supports it, and documented, tested account recovery so access can be restored if an account is compromised. For children, parental controls and safe-online guidance are tailored to age and activity. For elderly family members, scam-recognition guidance and simplified recovery address the threats most likely to affect them. The goal is security each person can actually maintain, not a standard that requires constant expert oversight.

Household staff credential and access security

Household staff security addresses three needs: credential hygiene, access discipline, and awareness calibrated to the household context. Credential hygiene means every staff member uses unique passwords managed through a password manager, with MFA enabled on any account that touches family information or household systems. This is often the first time household staff have used a password manager, so the implementation has to be simple, practical, and supported well enough that adoption is complete.

Access discipline means staff have access to exactly what their role requires, the security code for the residence they work in, the relevant calendar, the communication channels appropriate to their role, and that this access is reviewed when responsibilities change and revoked completely when employment ends. The staff member whose role does not require the principal’s financial correspondence should not have it. The contractor granted temporary access to a property platform for a project should lose it when the project concludes.

Awareness for household staff focuses on the social engineering scenarios they are most likely to encounter: requests for sensitive information from callers or emailers claiming association with the family, verification procedures for unusual requests, and how to report anything that seems off without fear of overreaction or professional consequence. Armour trains household staff at the level of technical depth appropriate to their role and existing comfort. This family and staff protection sits inside the broader cybersecurity for high-net-worth individuals program rather than standing alone.

Access Revocation When Employment Ends

The departure of a trusted household employee creates a gap most principals and family offices do not close completely. The obvious items, returning keys and access cards, get handled. The less obvious items, resetting shared passwords the employee knew, removing their access to property management software, cloud services, household communication channels, and any personal accounts they helped manage, are frequently missed entirely. Those open access points may sit dormant for months or years before they are discovered or exploited.

A household offboarding protocol handles this systematically. At the end of any employment relationship, the protocol enumerates every system and account the employee had access to, resets every shared credential they knew, removes their individual accounts from every platform, changes any codes or PINs they knew for property access, and documents what was done and when. It applies to voluntary departures, involuntary terminations, and temporary placements that conclude at the end of an engagement. The consistency of the protocol matters more than its sophistication; what matters is that no access point is missed because no one thought to check it.

Across the HNWI households Armour assesses, former-staff access is one of the most common findings, and it is almost never malicious in origin. It is simply the access nobody revoked because the departure was amicable and the offboarding was informal. The households that avoid it are the ones that made revocation a checklist rather than a memory.

Frequently Asked Questions

Should our household staff know they are part of a cybersecurity program?

Yes, and the communication should be framed positively. Household staff who understand that the measures they follow exist to protect the family, and by extension to protect them from being inadvertently used as a path of attack, are more likely to adopt and maintain those measures consistently. Framing the program as a benefit, that you are providing tools and training that protect them professionally, works better than framing it as surveillance or restriction. Staff who feel they are trusted participants in a protective program rather than subjects of it are more cooperative and more likely to report unusual situations promptly.

How do you handle security for younger children?

Security for children is age-appropriate and parent-directed. For younger children, the focus is device configuration, parental controls, and account setup that parents manage rather than the child. For adolescents, it adds safe-online guidance covering privacy settings on social media, recognizing phishing and online scams, and the risks of sharing location or personal information publicly. The social media presence of teenage family members is a significant data source for attackers profiling HNWI families, so the guidance helps teens understand why privacy settings and thoughtful posting matter without framing it as restriction. All guidance is calibrated by the parents’ preferences and the child’s maturity level.

What happens to staff access if we use shared passwords for household systems?

Shared passwords for household systems, the security system, the property management platform, the smart home controls, are one of the most common security gaps in residential environments. When a shared password is known by multiple current and former staff members, it cannot be effectively revoked when any one person leaves without changing it for everyone, which creates operational disruption and is therefore rarely done promptly. The resolution is to move household systems to individual account access where the platform supports it, or to implement a password management practice that allows shared credentials to be changed systematically at departures without the chaos of coordinating redistribution under time pressure. Armour assesses and remediates shared credential situations as part of the household staff security engagement.

How often should we review household staff access?

Access review should happen at three trigger points: on hire, when responsibilities change significantly, and when employment ends. A scheduled annual review that confirms each staff member has access to exactly what their current role requires is also good practice, particularly for households with multiple staff whose responsibilities evolve. The review does not need to be lengthy; it is a confirmation exercise that can be completed in a conversation with the household manager or principal, producing a short record of what was confirmed and any changes made. The value is in preventing access accumulation, the gradual expansion of access that happens as staff take on additional responsibilities without the old access being reviewed.

The Bottom Line

If your own security posture is strong, the attacker does not give up; they move to the people around you. The spouse, the adult child, the personal assistant, and the household manager each hold a piece of access to your life, and each typically carries far less protection than you do. Securing them is not about distrust. It is about closing the doors an attacker will otherwise walk through, with unique credentials and MFA for every family and staff account, access scoped to what each role actually needs, and a revocation checklist that runs the moment anyone leaves. Armour’s cybersecurity for high-net-worth individuals practice builds that protection around the whole household, not just the principal.