He worked from home. That single fact became the structural fault line that a criminal network decided to exploit.
His name was publicly associated with professional work that made him a target. His home address was derivable from that association. Nothing about his location was hidden because nothing about the systems that track professionals treats residential addresses as sensitive information by default.
The attack was coordinated across two vectors. A package containing heroin arrived at his home address, timed to create a documented record of drug possession at that location. Immediately behind it came an armed SWAT team, dispatched by a false emergency call to that same address, responding to a fabricated threat of serious violence.
The goal was to have him arrested at gunpoint in his own home. Or worse.
Every step of the attack was built on a single starting point. His home address. A piece of information that was available because the same systems used to run a professional life, maintain a public presence, and operate any kind of business create a cross-referenced web that can be resolved to a physical location by anyone with moderate research skills.
For a small business owner who operates from a home office, or whose formation documents list a residential address, the exposure is identical. Your name is attached to your work. Your work is attached to your address. Your address is attached to every government database, domain registration, and merchant account that has ever processed a transaction in your name.
The sophistication required to mount this kind of coordinated physical attack is lower than most people assume. The attacker does not need to breach a database or compromise a system. They need the information that is already public and the patience to connect it.
What they need from you is already out there.
Look at the wreckage in this post. The RuleDraft Small Business Isolation Manual was engineered for this exact reality.