Doxxing executives: a first-day checklist

What doxxing is, and why executives are targets

The US Cybersecurity and Infrastructure Security Agency (CISA) defines doxing as "the internet-based practice of gathering an individual's personally identifiable information (PII)", or an organization's sensitive information, "from open source or compromised material and publishing it online for malicious purposes." This article uses the more common spelling, doxxing; CISA uses doxing. The glossary entry has the short version.

CISA wrote its guidance for critical infrastructure organizations, and it names their senior leaders as a target group, saying they "may be targeted due to their elevated position with the organization or stance on a particular issue." It describes doxing aimed at senior leaders as often serving as "reputation attacks", and warns that doxing aimed at personnel and facilities "can potentially escalate to physical violence."

The same guidance lists the sources doxers draw on: social media posts, property and court records, wedding announcements and obituaries, newsletters, public conferences, web forums and voter registration lists. It also says doxers "compile sensitive information from compromises of personal and professional accounts." Compromised accounts are where breach data enters a dox, and that part keeps causing damage after the post comes down.

Why breach data makes a dox worse

A published home address is a safety problem. A published personal email address next to a password that still works is an account problem, and one dox can contain both.

The FBI has documented one way they combine. In a December 2020 public service announcement on swatting, a hoax emergency call meant to draw a law enforcement response to a specific location, the FBI said offenders were "using stolen e-mail passwords to access smart devices with cameras and voice capabilities and carry out swatting attacks." It said they were likely "taking advantage of customers who re-use their email passwords for their smart device." The address came from one source and the access from a reused password. See swatting and password reuse.

Phone numbers carry a similar risk. The FBI's 2022 PSA on SIM swapping describes criminals tricking a mobile carrier into moving a victim's number to a SIM card they control, then using SMS one-time codes to reset passwords and take over accounts. The same PSA advises people to avoid "posting personal information online, such as mobile phone number, address, or other personal identifying information." A dox does that posting for them.

The first-day checklist

The order below follows CISA's guidance for victims (report, understand the threat, remove, monitor), with the account steps from the FBI and FTC added where a dox makes them urgent.

First hour: safety and evidence

1. If anyone's physical safety is threatened, contact local law enforcement. CISA's guidance says to do this when there is concern about physical safety.
2. Tell corporate security and whoever is responsible for the executive's protection, travel and home. CISA lists the organization's security office first among the places to report.
3. Record everything before it moves. CISA advises documenting what occurred and taking screenshots to share with investigators and administrators. Capture the URL, the date and time, the account that posted, and every field that was published.

First four hours: report the posts

4. Report to the platforms and website administrators that host the post. CISA lists social media platforms and website administrators among the places to report.
5. Report to the FBI's Internet Crime Complaint Center (IC3) at ic3.gov. CISA suggests considering this step.
6. Decide on removal requests with the legal team. Asking a platform or site to take content down is the executive's or the legal team's action, and the screenshots from step 3 support it. For people-search listings, WebThreat's information removal specialists file the opt-outs and takedown requests and verify each removal.

Same day: close the accounts the dox makes easier to attack

7. Work out what was exposed and where it came from. CISA calls this understanding the threat: what information was exploited, how serious the threat is and what the point of compromise was. A dox that includes a personal email address or an old password points to a breach.
8. Change passwords on every online account, starting with email. CISA's guidance says to change log-in and password information for all online accounts. Prioritize any password that appears in breach data and is still in use. The FBI's swatting PSA advises against using the same password across accounts. Our guide on what to do when an executive's password is in a breach covers the order.
9. Move multifactor authentication off SMS. The FBI's SIM swap PSA recommends "biometrics, physical security tokens, or standalone authentication applications."
10. Protect the mobile number. The same PSA advises not giving mobile account information to callers who ask for it, verifying such calls by dialing the carrier's customer service line, and watching for changes in SMS connectivity. See SIM swap and our guide to SIM swap attacks on executives.
11. Secure cameras and smart home devices at the published address with unique passwords and two-factor authentication, as the FBI's swatting PSA advises.
12. Freeze credit for the executive and, where relevant, family members. The FTC says a credit freeze is free, does not affect the credit score, lasts until it is lifted, and requires contacting each of the three credit bureaus: Equifax, Experian and TransUnion. A fraud alert is also free and lasts one year; contacting one bureau is enough, because it must tell the other two. Both are US mechanisms. The EU has no single credit freeze: credit reporting is organised country by country, so ask the national credit bureau which fraud flag or block it offers, and use the right of access in Article 15 of the General Data Protection Regulation to see what a bureau holds about the executive.
13. Watch financial accounts. CISA advises watching for signs of identity theft, monitoring financial accounts and setting up fraud alerts.

Same day: warn the people around the executive

14. Brief the assistant, reception, family and finance team. A dox gives an attacker the names and details for convincing pretext calls. CISA advises being suspicious of unsolicited phone calls, visits or emails from people asking about employees or other internal information.
15. Tighten payment verification for the next weeks. Exposed personal details make impersonation of the executive easier. The FBI's guidance on business email compromise advises confirming transfer requests by phone using "previously known numbers, not the numbers provided in the e-mail request." Our article on which exposed data fields make CEO fraud convincing explains why.

The first week: reduce what can be found next time

CISA's preventive guidance applies once the first day is over:

• Audit personal and organizational social media accounts: set the strongest privacy controls, deactivate or delete profiles no longer in use, review followers, and remove PII such as address, date of birth and phone number from profiles.
• Remove unnecessary mobile apps and browser extensions, which CISA notes can collect personal data.
• Search regularly for unwanted pictures and information about the executive, on the assumption that anyone can see what is shared online.
• Request removal from public records websites, which CISA says periodically scrape public-facing websites and compile names of relatives, addresses, photographs and real estate records.

Listings on people-search sites are a separate job from breach data. WebThreat's information removal specialists audit those listings, file the opt-outs and takedown requests, and verify each removal. Closed listings are re-checked every 30 days. For how the two kinds of work differ, see data removal vs breach monitoring.

How CEM finds the breach data behind a dox

Steps 7 to 10 depend on knowing which of the executive's credentials and contact details are already exposed. CEM checks executives against breach corpora and leak databases and shows the fields found for each person, such as email addresses, phone numbers, passwords and usernames, ranked by what to fix first (see the methodology).

Breach data shows what has leaked: which passwords, email addresses and phone numbers are exposed. Listings on people-search sites are covered by information removal. Breach data cannot be deleted from the copies already in circulation, which is why the response focuses on making the exposed data useless: new passwords, stronger MFA and verified payments.