Doxxing

How it works

CISA defines doxing as the internet-based practice of gathering an individual's personally identifiable information, or an organization's sensitive information, from open source or compromised material and publishing it online for malicious purposes. It notes that anyone able to query and combine public data can do it, though it is often attributed to state actors, hacktivists and extremists.

Doxers compile profiles from compromises of personal and professional accounts and from a wide range of public sources. CISA's list of examples of sensitive information includes full name, contact information, home address, family members, workplace details, financial information and Social Security number. Its list of common sources includes social media posts, property and court records, wedding announcements and obituaries, public conferences, web forums and voter registration lists.

Why executives are targeted

CISA's guidance, written for critical infrastructure organizations, states that doxing poses a threat to their senior leadership, who may be targeted because of their elevated position or their stance on an issue. Such attacks often serve as "reputation attacks" and may aim to embarrass, harass or undermine confidence in an official. CISA also warns that doxing aimed at personnel and facilities can escalate to physical violence. Doxxed details can feed related harassment such as swatting.

Breach data contributes to the profile. Records from past breaches can hold phone numbers, personal email addresses and addresses that the executive never published. Doxxing executives: a first-day checklist covers what to do once a leak has happened.

Reducing the risk

CISA recommends auditing social media accounts, using the strongest privacy settings, removing PII such as address, date of birth and phone number from profiles, and deleting profiles no longer in use. It also recommends requesting removal of personal information from public records websites, and being suspicious of unsolicited calls, visits or messages that ask about employees or internal information.

If it happens, CISA's guidance is to report the incident to the organization's security office, local law enforcement, the social media platform and website administrators, and to document it with screenshots. It also advises determining what information was exploited, working to remove it, and watching for identity theft. If physical safety is a concern, contact local law enforcement.

WebThreat's Information Removal specialists audit people-search and data broker listings about executives, file the opt-outs and takedown requests on the customer's behalf and verify each removal. Closed listings are re-checked every 30 days, and family members are covered on request.

How it differs from related terms

Doxxing is publication of personal information, while pretexting is one way of obtaining it. Swatting is a hoax emergency call that may use doxxed details. PII is the data itself.