Doxxing (also spelled doxing) is the act of collecting someone's private or identifying information and publishing it without consent, usually to harass, intimidate, humiliate, or endanger them. Details that seem ordinary on their own can become much more consequential when someone assembles and distributes them.
Doxxing has grown alongside the people-search sites and data brokers that make that assembly easier: the FBI's Internet Crime Complaint Center logged 21,557 harassment and stalking complaints in its 2025 Internet Crime Report, up from 11,672 the year before, and that tally only counts cases victims chose to report.
Key Takeaways
Doxxing works by merging scattered public and leaked data into one profile and posting it where strangers will use it.
Forms of doxxing vary by what attackers expose and whom they target, from unmasking anonymous accounts to publishing judges' and election workers' home addresses.
Victims can combine evidence preservation, platform removal, account security, and formal reporting when responding to an incident.
The same exposed details that fuel harassment also support spear phishing, account recovery fraud, and executive impersonation, which makes employee privacy an organizational security concern.
What Information Doxxers Look for
Doxxers hunt for specific categories of personal data, each useful for a different kind of harm:
Home Address: A home address lets strangers locate or visit the target.
Phone Number: A phone number enables harassing calls and subscriber identity module (SIM) swaps.
Personal Email: A personal email ties accounts together and supports phishing email attacks.
Social Security Number: A Social Security number enables identity theft and account fraud.
Workplace and Job Title: Workplace information points harassers toward an employer.
Family Members' Names: Family details extend the exposure to relatives.
Financial and Bank Details: Financial details expose the target to fraud.
Medical Records: Medical records can embarrass or discredit a target.
Legal and Court Records: Legal records can undermine credibility.
Private Messages: Private messages can humiliate or discredit a target.
Photos with Location Data: Photos can reveal where someone lives.
Account Credentials: Credentials allow takeover of email or social accounts.
Any single item on this list can seem harmless alone, but a doxxer who gathers several builds a profile detailed enough to locate, impersonate, or extort the target.
How Doxxing Works
Most raw material for a dox is already public, so a motivated actor can build a detailed profile with techniques like the following:
Seed Searches: The doxxer starts with a username, email address, photo, or real name, then hunts for overshared details like a pet's name, schools attended, or family members.
Sock Puppet Accounts: Fake profiles let the doxxer view content that sits behind a login.
People-Search Sites and Data Brokers: These services combine online and offline sources into per-person profiles.
Public Records: Property, court, and voter records, plus obituaries, add addresses, relatives, and other details.
Username Matching: Comparing similar handles across platforms links separate accounts to one person.
Historical WHOIS Records: Past domain registrations can expose a site's owner even when current records are anonymous.
Reverse Image Searches: A single photo can surface other profiles and pages where it appears.
Unstripped Photo Metadata: Global positioning system (GPS) data left in an uploaded image can reveal a user's location.
Breach Dumps: Past data breach records can tie an anonymous email to a real name or address.
Social Engineering and Phishing: Social engineering tactics and phishing fill gaps that open sources miss.
Writing-Style Correlation: Quirks in a forum persona's writing can reveal the person behind it.
Doxxers post the finished profile on doxxing sites, social platforms, messaging channels, or dark web forums, usually with a call to action, and some sell compiled doxxes.
Types of Doxxing
People commonly sort doxxing by the information exposed and the target. This includes:
Deanonymizing Doxxing: Deanonymizing doxxing reveals the real identity behind an anonymous account without directly disclosing where the person lives.
Targeting Doxxing: Targeting doxxing publishes a home address, phone number, or credentials that let someone locate or contact the target.
Delegitimizing Doxxing: Delegitimizing doxxing releases medical, legal, or financial records, private messages, or photos to undermine credibility.
Revenge and Coercive-Control Doxxing: Someone with a grudge, sometimes a former partner, publishes details to punish the target. Technology-facilitated coercive control can appear after relationship breakdowns.
Swatting-Linked Doxxing: A published address feeds a hoax emergency call, and swatting has caused deaths when police mistakenly shot innocent residents.
Organizational and Critical-Infrastructure Doxxing: People with grievances against an organization target its personnel, and incidents can escalate to physical violence.
Executive-Targeted Exposure: Attackers target senior leaders' personal and company details. After the December 2024 shooting of a health insurance executive, insurers pulled executive details from their websites to reduce that exposure.
Election Official Doxxing: Attackers publish election officials' personal details, as on an Iranian-run site that federal agencies reported.
Judicial and Public Official Doxxing: Attackers expose judges' home addresses. An attacker who had compiled a dossier of a judge's personal information, including her home address, killed her son at the family's home.
Public Health Worker Doxxing: Attackers post health officials' details. During the pandemic, a Colorado politician shared their names and home addresses in a social media group.
Journalist and Critic Doxxing: Critics of an organization become targets. In 2019, security staff at an online marketplace ran a cyberstalking campaign against a couple who published a critical newsletter, posting their home address online along with fake party invitations meant to draw strangers to the house, and former staff were sentenced to federal prison in 2022.
Peer and Adolescent Doxxing: Students expose classmates' identities or contact details.
Gaming-Community Doxxing: Players in online multiplayer communities expose rivals' real identities or addresses.
These categories overlap, and violent online networks may threaten to both dox and swat victims as an extortion tactic.
Is Doxxing Illegal?
Whether doxxing is a crime in the United States depends on whom the doxxer targets, what the doxxer intended, and which state hears the case.
No general federal doxxing crime covers private individuals. The federal restricted information statute makes it a crime to publish a covered official's Social Security number, home address, phone number, or personal email with intent to threaten, intimidate, or incite violence and authorizes a sentence of up to five years.
Because prosecutors face difficulty applying current federal law to doxxing, they can also use cyberstalking, interstate threats, or extortion laws. The attack on Judge Esther Salas's family mentioned earlier prompted Congress to enact the Daniel Anderl Judicial Security and Privacy Act, which shields federal judges' personal data.
According to the Council of State Governments, as of June 2025 some states, such as California, Kentucky, and New Jersey, allow both criminal prosecution and civil suits, while others, such as Florida and Virginia, treat doxxing solely as a crime. Penalties range from misdemeanors to serious felonies.
Selected current and proposed doxxing-related laws include:
Jurisdiction | Law | Key Provision
|
|---|---|---|
Illinois | Civil Liability for Doxing Act | Victims can seek damages and injunctions |
California | Doxing Victims Recourse Act (AB 1979) | Gives doxxing victims a civil cause of action |
Indiana | Senate Enrolled Act 140 (SB 140) | |
Hong Kong | Privacy amendment ordinance | Establishes fines and imprisonment for higher-tier offenses |
Netherlands | Criminal code change | Authorizes imprisonment for doxxing |
Australia | Privacy amendments | Establishes doxxing offenses carrying prison sentences |
United Kingdom | Online Safety Act 2023 | Establishes a threatening communications offense but no doxxing-specific crime |
Doxxing is not a recognized category of unprotected speech, so laws that criminalize publishing truthful information can face First Amendment challenges.
Why Doxxing Threatens Organizations
Exposed employee information doubles as reconnaissance for attacks on the employer, which puts doxxing on the security team's agenda alongside human resources and physical security. That IC3 total mentioned at the beginning covers harassment and stalking broadly rather than doxxing specifically, but the trend line still points toward more exposed personal data reaching attackers.
The following risks show how doxxed data translates into concrete attack vectors against organizations:
Spear Phishing: Employee names yield email addresses, and personal details make lures believable. Because this identity gathering happens outside enterprise defenses, reducing externally available data is the main preventive measure.
Account Recovery Fraud: Security questions offer weak protection because attackers can often discover answers such as a pet's name, schools attended, or date of birth online.
SIM Swapping: A phone number and biographical details can help an attacker impersonate the account holder to a carrier. SIM swapping moves a victim's number to an attacker's SIM card and can enable credential theft.
Executive Impersonation: Business email compromise (BEC) depends on leader impersonation attacks, and exposed personal details strengthen that impersonation.
Combined Threat Campaigns: In a CISA doxxing case study, a distributed denial-of-service (DDoS) attack on the hospital followed shortly after threats containing hospital staff home addresses and phone numbers. CISA also warns that such incidents can escalate to physical violence.
Each of these risks starts with information a victim never meant to expose, which is why reducing externally available data functions as an organizational control, not just a personal one.
How to Prevent Doxxing
Doxxing prevention reduces the personal data an attacker can find and raises the cost of using what remains. The following measures help individuals and organizations shrink their exposure:
Data Broker Opt-Outs: Broker opt-outs need repeating because data reappears when public records change. Californians can reach every registered broker in one request through the state's Delete Request and Opt-out Platform.
Private Social Accounts: Many platforms default to public, so private settings reduce access to the easiest reconnaissance source.
Profile Pruning: Deleting unused accounts and old posts removes accumulated location clues.
Separate Identities: Keeping birthdays, phone numbers, addresses, and family names off professional profiles, and using unique usernames, stops doxxers from chaining accounts.
Unique Passwords and Multi-Factor Authentication: Multi-factor authentication (MFA) on every account, including smart-home devices, plus a unique password for each account limits breached credential reuse attacks.
Metadata Awareness: Checking files before uploading matters because some platforms strip photo GPS data and some do not.
Domain Privacy: Hidden WHOIS details keep a personal website from revealing a home address.
Self-Monitoring: Name, phone, and address alerts, plus periodic reverse image and logged-out self-searches, surface exposure early.
Household Planning: Discussing swatting with family and agreeing how to respond to an unexpected police visit prepares everyone for a hoax call.
Directory Delisting: Targeted people can ask campuses or institutions to remove them from directories.
Staff and Family Data Hygiene: Organizations can remove employee details from websites and social profiles and apply strict controls to professional and personal accounts.
Impersonation Training and Verification: Security awareness training on impersonation, phishing-resistant MFA, and secondary challenges such as a rolling passphrase limit misuse of a stolen profile.
Incident Planning: Tabletop exercises, physical security assessments, formal incident response planning, and set reporting channels shorten response time.
Employers control the staff-facing measures; individuals control the rest.
How to Respond to Doxxing
The first hours matter most, and physical safety and evidence come before takedowns, account lockdown, and reporting. Victims and employers can work through the following steps in order:
Physical Safety: Calling 911 is appropriate when you or your family face an immediate safety risk, and staying elsewhere temporarily may be safer.
Evidence Preservation: Screenshots of posts with usernames, dates, and links, along with emails saved as PDFs, voicemails, and texts, preserve evidence before anyone reports or blocks an account.
Platform Takedowns: Major social and search platforms accept reports or removal requests for posts and results that expose private residential or contact information.
Account Lockdown: Changing passwords and PINs, turning on MFA, and adding a carrier PIN help block account takeover fraud and SIM swapping.
Formal Reports: A local police report creates formal documentation even if no further action follows, and the FBI's IC3 accepts complaints regardless of dollar loss.
Employer or School Notification: Some employers and unions offer legal support, and some universities temporarily remove contact details from department pages.
Broker Removals: Removal requests can take time, so early requests shorten the exposure window.
Financial Protection: Fraud alerts and credit freezes are free, and the federal identity theft recovery service provides a recovery plan.
Legal Options: States with a civil cause of action allow suits for damages, and protective orders work best inside a broader safety plan.
Support Network: Trusted people can monitor accounts and offer a safe place to stay, and the Cyber Civil Rights Initiative runs a helpline at 844-878-CCRI (2274).
For employers, the CISA Security Planning Workbook covers short- and long-term recovery planning, including public messaging.
Making Your Personal Data Harder to Weaponize
Doxxing turns scattered facts into tools for harassment, fraud, physical targeting, and cyberattacks. Legal protection varies by victim and jurisdiction, and it rarely covers every channel an attacker can use. Individuals and organizations can reduce that exposure by removing unnecessary data, protecting remaining accounts with strong authentication, and preparing coordinated response procedures. Regular exposure reviews and practiced response plans provide a practical foundation for managing future incidents.
Frequently Asked Questions
Can a Credit Freeze Remove Doxxed Information?
No. A credit freeze limits access to a credit file and can reduce identity fraud, but it does not remove personal information from websites, search results, social platforms, or data broker profiles.
Can Doxxing Affect Family Members?
Yes. A dox may include relatives' names, addresses, phone numbers, workplaces, or social accounts. That information can extend harassment, impersonation, and unwanted contact beyond the original target.
What Is an Address Confidentiality Program?
An address confidentiality program is a state-run service that gives eligible crime victim-survivors, such as people facing stalking or domestic violence, a substitute mailing address to use on public records, with the state forwarding their mail. These programs have limits and may not protect every type of public record, including some property records.