A principal's security arrangements are themselves a record. The firm employed, the personnel deployed, the routine of the protection: each is knowable to a determined observer, and each says something about the principal's level of concern, the periods of greater risk, and the family members covered. The arrangement that was supposed to be invisible is itself a signal.
The leaks come from several places. The protection firm's marketing material occasionally names principals with consent that the principal granted years ago and forgot. The professional histories of former protection personnel appear on professional networks, and their tenure with a principal is often readable from the dates. Court filings in cases involving the protection firm name clients in passing.
The work is in how the arrangement is contracted (with explicit terms on what may be referenced, by whom, where), in what is documented in writing, and in the discipline of treating the protection arrangement as itself a category of exposure that requires the same attention as any other.
An accurate picture of the present record is the minimum any considered response requires.
More from the desk
The medical record and the clinic that holds it
The personal cloud storage and what it quietly holds
The phishing that knows your name and your bank
How a SIM swap works, and what it takes from you
The public company board seat and the disclosure it creates
The business of finding things out, and the customers it serves