[nivertech]

It depends on the industry.

It's not about guessing user IDs, but about deducting some useful information about them.

For example if an attacker may deduct wether an employee in a company a senior or a new one, and will know when exactly they joined the company.

[Grimburger]

> an attacker may deduct wether an employee in a company a senior or a new one

I'd probably start with LinkedIn first :)