Here's an interesting article from a journalist who paid a private investigator to investigate him to see what he could discover back in 1999 and compared it to seeing what an ethical hacker could find today. Interesting results, although the 1999 techniques (largely social engineering) would probably still bear fruit today...