Doxxing (also “doxing” or “personal data exposure”) is the practice of researching and publishing private personal information of an individual on the internet with malicious intent, generally to harass, intimidate, or cause harm. It is a form of cyberbullying that violates privacy and can have legal consequences according to GDPR and data protection laws, potentially including techniques such as OSINT (Open Source Intelligence), social engineering, and metadata analysis to gather and expose sensitive personal information about victims.

What is Doxxing?

Doxxing (also written “doxing”) is an attack that consists of collecting and publicly exposing personally identifiable information (PII) of a person without their consent, including addresses, phone numbers, financial information, and other sensitive data.

Features

Exposed Information

  • Personal Data: Names, addresses, phone numbers
  • Financial Information: Card numbers, bank accounts
  • Family Data: Information about family and contacts
  • Digital History: Social networks, past posts
  • Location: Physical addresses, frequented places

Collection Methods

  • OSINT: Open source intelligence research
  • Social Engineering: Manipulation to obtain information
  • Data Breaches: Access to compromised databases
  • Phishing: Identity spoofing techniques
  • Metadata Analysis: Data extraction from files

Types of Doxxing

By Motivation

  • Revenge: Retaliation for personal or professional disputes
  • Harassment: Continuous intimidation and harassment
  • Extortion: Pressure to obtain economic benefits
  • Activism: Exposure of public or corporate figures
  • Cyberbullying: Systematic online harassment

By Scope

  • Individual: Targeted at a specific person
  • Family: Extension to family and contacts
  • Organizational: Information about companies or institutions
  • Collective: Multiple simultaneous victims

Impact and Consequences

Personal

  • Compromised Privacy: Loss of control over personal information
  • Physical Security: Risk of harassment or physical violence
  • Emotional Stress: Anxiety, depression, fear
  • Reputation: Damage to personal or professional image
  • Relationships: Impact on family and friends

Professional

  • Career: Loss of employment or opportunities
  • Business: Damage to companies or ventures
  • Credibility: Erosion of trust and reputation
  • Financial Stability: Direct economic impact
  • Civil Liability: Lawsuits for damages
  • Criminal Proceedings: Criminal investigations
  • Regulations: Violation of data protection laws
  • Fines: Sanctions for non-compliance

Protection and Prevention

Personal Measures

  • Privacy Settings: Strict settings on social networks
  • Limited Information: Share only what is necessary
  • Identity Separation: Different profiles for different contexts
  • Regular Monitoring: Review of publicly available information
  • Education: Awareness of digital risks

Technical Measures

  • VPN: Hide IP address
  • Metadata Protection: Removal of file data
  • Strong Passwords: Robust authentication
  • Two-Factor Verification: MFA on all accounts
  • Privacy Tools: Protection software

Organizational Measures

  • Privacy Policies: Clear protection standards
  • Training: Education on doxxing and protection
  • Incident Response: Response procedures
  • Monitoring: Detection of information exposure
  • Support: Resources for victims

Response to Doxxing

Immediate

  • Documentation: Capture evidence of doxxing
  • Notification: Inform platforms and authorities
  • Removal: Request content removal
  • Security: Change passwords and enable MFA
  • Support: Contact help lines
  • Report: Report to competent authorities
  • Legal Advice: Consult with specialized lawyers
  • Protection: Restraining orders if necessary
  • Compensation: Seek compensation for damages

Recovery

  • Containment: Limit information spread
  • Reputation: Image management strategies
  • Support: Therapy and emotional support
  • Future Prevention: Improvement of protection measures

Regulations

  • GDPR: Personal data protection in Europe
  • CCPA: California privacy law
  • Data Protection Law: Applicable local legislation
  • Cyberbullying Laws: Protection against digital harassment

Sanctions

  • Fines: Economic penalties
  • Prison: Sentences for serious crimes
  • Civil Liability: Compensation to victims
  • Restrictions: Contact prohibitions

Use Cases

Child Protection

  • Education: Teach children about privacy
  • Supervision: Monitor online activity
  • Configuration: Strict privacy settings
  • Communication: Open dialogue about risks

Professionals

  • Journalists: Protection of sources and information
  • Activists: Security for human rights defenders
  • Executives: Protection of business leaders
  • Researchers: Security for academics

Best Practices

Prevention

  • Data Minimization: Share only essential information
  • Regular Review: Audit of public information
  • Secure Configuration: Optimal privacy settings
  • Continuous Education: Update on threats
  • Protection Tools: Use of security software

Response

  • Quick Action: Immediate response when detecting doxxing
  • Coordination: Work with platforms and authorities
  • Documentation: Complete incident record
  • Support: Assistance to victims
  • Continuous Improvement: Learning from incidents

References