Hackers Start Small to Ensnare Big Targets

It may sound like a crazy collection of unrelated information. But just as a corporation may use big data to figure out what a consumer might buy based on their past purchases, a spy agency can use big data to make connections to useful intelligence.

“A lot of people overlook why some of these seemingly purposeless breaches matter,” Mr. Kanuck said.

Intelligence services could match international flights taken by their own officials with those taken by American personnel to the same cities at the same time. They could comb the user names and emails released in a hacking of Ashley Mad- ison, a site used by those seeking extramarital affairs that was breached last year, with the personal Yahoo accounts of government officials and contractors or their spouses, and leak that information.

And they can use the most intimate details of people’s lives — their medical records — to undercut the reputations of prominent American athletes, as Russian hackers did in a release of medical records stolen from the World Anti-Doping Agency that belonged to the gymnast Simone Biles, the tennis stars Venus and Serena Williams and other Olympic athletes.

The biggest worry, Mr. Kanuck and other American intelligence officials say, is the impact these data thefts can have on global politics.

“In the past year, we’ve seen personal webmail accounts and social network accounts specifically being targeted by Russian, Chinese and Iranian espionage operators, on several occasions,” said John Hultquist, an espionage analysis manager at FireEye, the security software company. “That’s where some of the most sensitive conversations take place, and hacking private accounts leaves a much lighter footprint.”

One of the most adept at this approach has been a Russian intelligence hacking group alternately known in the security and intelligence community as APT28, Fancy Bear or Pawn Storm. In just the last few months, the group has been blamed for attacks on the Democratic National Committee, the White House and the World Anti-Doping Agency.

Among the Russians’ targets were Colin L. Powell, the former secretary of state, whose personal emails caused a sensation when they were leaked online recently.

Mr. Kanuck said no one should be shocked that this is going on. “Every prominent person in Washington, every publicly known intelligence official, congressman and significant staffer should presume they have been targeted,” Mr. Kanuck said. “You’d be a fool not to think that’s the case.”