A digital footprint
is not deleted. It is
found, then closed.

One address links every account you have ever opened. Fed into breach corpora it returns the services you forgot you joined, and often the passwords you used there. That is where an attacker starts, because it is cheap and it works: not by breaking into your bank, but by finding an old forum password you reused and trying it everywhere. Closing it means knowing which breaches contain you, retiring the reused credentials, and separating the address that receives your password resets from the one you hand out.

A number posted once on a business page or a classified advert stays searchable for years, and it is frequently the recovery route for an email account, a bank app and mobile money at the same time. That makes control of the SIM equivalent to control of the identity. Closing it means moving second-factor authentication off SMS wherever the service allows, understanding what your carrier will and will not do to reissue a SIM, and taking the number off the pages that publish it.

A dormant account is more dangerous than an active one. Nobody is watching it, the password is a decade old, the recovery address may belong to a mailbox you no longer control, and it still holds photographs, contacts and messages. Old services also get bought, merged and breached long after you stopped caring about them. Closing it means finding them — which is the hard part — then recovering, emptying and deleting rather than simply walking away again.

Some platforms strip the data embedded in an image and some do not, and a file sent directly — over email, over a messaging app as a document rather than a photo — usually keeps it: the device, the timestamp, sometimes the coordinates. Even stripped, the frame itself gives up a street, a uniform, a number plate, a school badge, a view from a window. Chan-Piu has spent twenty years reading what is in a frame; the same eye is what this part of the audit uses.

Company registrations, domain records, court listings, tender awards, professional directories and church or school notices are all published deliberately and indexed permanently. Individually each one is unremarkable. Assembled, they give a home area, a set of relatives, a business address and a rough financial position. Closing it is partly redaction where a registry allows it, and partly knowing which combinations are dangerous so the rest can be managed rather than panicked over.

Almost nobody is targeted personally. What actually happens is automated: lists of addresses and passwords from old breaches are replayed against hundreds of services until something opens. Reuse is what turns a trivial leak into a total one. Closing it means a manager holding a different credential for every service, hardware or app-based second factors on the accounts that matter, and a deliberate order of work — email first, because email is how everything else is reset.

Perfect passwords are irrelevant if the phone holding them is unencrypted, unpatched, signed into an account you have forgotten, or carrying an app with permissions nobody has reviewed since it was installed. Backups deserve the same attention and rarely get it. Closing it means encryption on, updates current, screen locks that are actually used, permissions pruned, sessions on old devices revoked, and a recovery plan that works when the device is lost rather than after.

Your own accounts can be immaculate while a relative's public profile names your children's school, or a colleague's contact list carries your private number into an app that uploads it. For a business the same problem wears a suit: a member of staff reusing a personal password on a work login, or an assistant with access nobody removed after they left. This is the part people find uncomfortable and it is usually where the real exposure is, which is why the audit covers it rather than politely stopping at the individual.