That cute photo of your fluffy Lagotto Romagnolo on Instagram. The TikTok video of your team finally back together in the office. An alma mater highlighted on your LinkedIn page.

Armed with all that publicly available intel, a cybercriminal can cobble together a profile of you—and use it in countless ways to break into your company’s network.

They might craft an email tailored to your interests (“Hello fellow dog lover!”) that gets you to click on a dubious link, inadvertently giving them access to the network, or insider details about service providers like your health-insurance company, so they can launch a ransomware attack. Or they might pretend to be you to trap somebody else at your business (“Hey, it’s Cindy’s birthday next week, click on this link to accept the invite to her party.”). And so on.

“About 60% of the information I need to craft a really good spear phish is found on Instagram alone,” says Rachel Tobac, chief executive officer of SocialProof Security, a hacker-led vulnerability-assessment and training firm. By scouring somebody’s social-media accounts, she says, “I can usually find everything I need within the first 30 minutes or so.”

It isn’t just things that you post, either. “Every ‘like’ you make on Facebook and heart you tap on Instagram can be aggregated together to paint a fairly clear picture of who you are and what you are into,” says Carrie Gardner, a cybersecurity engineer and leader of the Insider Risk Team at Carnegie Mellon University’s Software Engineering Institute.