After a badge dump leaks, attackers use AI to merge the dump with professional profiles and highlight which accounts likely have privileged access. What AI-enhanced attack step is shown?

After a badge or identity dump leaks, attackers use AI to correlate leaked records with open-source professional profiles, highlighting which municipal accounts likely hold privileged access for follow-on abuse. That automated correlation turns a raw dump into a privilege map—who to phish, who to password-spray, and which roles unlock finance, OT, or admin systems—far faster than manual cross-referencing. AI-generated spear-phishing drafts built from open-source profiles to gain initial access is a follow-on initial-access tactic, not the AI correlation of leaked identities with OSINT privilege signals that maps privileged accounts. Automated cracking of leaked password hashes with AI wordlists to recover plaintext logins is a credential-recovery attack, not privilege mapping from dumps via correlation with open-source professional profiles. Automated cloning of badge IDs from leaked dumps to bypass physical access controls is a physical-access abuse tactic, not attack-side identity analytics on a leaked dump. Exam caveat: leak plus OSINT plus AI ranking of privileged accounts describes automated correlation for privilege mapping—ignore AI-generated spear-phishing drafts, hash cracking with AI wordlists, and badge-ID cloning distractors. Operational check: after any identity dump, force resets and session revocation for exposed staff, prioritize monitoring on privileged roles surfaced publicly, reduce oversharing of titles and access hints online, and treat correlated privilege lists as actionable threat intel for awareness and detection tuning.