Doxing is the collection and public release of someone’s private information – such as home address, phone number, employer or family details – without consent, usually to harass, intimidate or expose them.
How doxing works
The term comes from “dropping docs” (documents), hacker slang from the 1990s. Doxers combine scattered pieces of information into a single profile and publish it on forums, Telegram channels or paste sites. Typical sources:
- open source intelligence: social media posts, photos with location data, domain registration records and public registries;
- data broker and people-search websites;
- leaked databases from breaches, which link emails, phone numbers and passwords;
- social engineering of friends, employers or support staff, and account takeovers.
Even small details in a person’s digital footprint – a username reused on several sites or the view from a window – can be enough to identify them.
Why doxing matters
Doxing exposes personally identifiable information and can lead to stalking, threats, job loss and “swatting” – false emergency calls that send armed police to the victim’s home. Journalists, activists, researchers, gamers and public officials are common targets. Hacktivists and ransomware gangs also dox employees and executives to pressure organisations. Several countries treat malicious doxing as a criminal offence, and the GDPR restricts publishing personal data in the EU.
How to protect against doxing
- Use different usernames and email addresses for different services.
- Limit personal details and location data in public profiles and photos.
- Ask data brokers to remove your records and use privacy options for domain registration.
- Enable two-factor authentication and check whether your accounts appear in known breaches.
