Doxxing, short for “document tracing,” refers to the act of publicly disclosing someone’s personal information, like their real name, home address, phone number, or even financial data, without consent. This malicious practice can lead to harassment, identity theft, and other forms of online abuse. So, how do people get doxxed, and what can you do to protect yourself?
Key takeaways
- Doxxing and employee reconnaissance use the same four sources: social media, weak credentials, breach data and public records.
- Against an organization, the assembled profile is not the attack, it is the preparation for one.
- Executives, help desk staff and finance teams are profiled most often, because each holds a form of authority worth hijacking.
- Exposure can be measured. Most of what an attacker uses is public and can be inventoried before it is exploited.
The same techniques are used against employees. When the target is a finance manager or a help desk agent rather than a private individual, the assembled profile stops being harassment material and becomes the raw input for a social engineering attack.
Common Ways People Get Doxxed
1. Social Media Oversharing
Many people unknowingly share too much information on social media. Details like your full name, birthday, and even location can be pieced together by cybercriminals. Even innocent-looking posts can give clues to your personal life.
2. Weak Passwords and Poor Security Practices
Using weak passwords or reusing the same password across multiple platforms makes it easier for attackers to gain access to your accounts. Once inside, they can retrieve sensitive data that can be used for doxxing.
3. Data Breaches
With data breaches becoming increasingly common, your personal information may already be available on the dark web. Hackers often collect this data from breached websites, databases, or compromised accounts to build a profile for doxxing.
4. Publicly Accessible Information
Some information is publicly available through voter registration, public records, or online databases. Attackers can exploit this readily available data to doxx their victims. In a corporate context the equivalent sources are company registries, conference speaker lists, job postings that name internal tools, and LinkedIn profiles that expose reporting lines. None of it requires any intrusion.
How to Protect Yourself from Being Doxxed
- Limit Social Media Exposure: Avoid sharing personal information, such as your address, phone number, or family details, on public platforms.
- Use Strong Passwords and 2FA: Implement strong, unique passwords and enable two-factor authentication (2FA) for all accounts.
- Monitor Data Breaches: Use services that alert you if your information appears in a breach and act quickly to secure those accounts.
- Be Mindful of Public Records: Regularly check what personal information is accessible publicly and take steps to remove or limit it.
Staying vigilant and practicing good cybersecurity hygiene can significantly reduce the risks of getting doxxed. Always prioritize your online safety.
How does doxxing become a corporate attack?
Doxxing an individual and profiling an employee are the same activity with different objectives.
Against a private person, the assembled file is the attack. Against an organization, it is the preparation. An attacker who knows a finance manager's name, their manager's name, the payment tool they use and the week they are on holiday has everything needed to place a convincing call to accounts payable.
This reconnaissance step is why modern social engineering works. Google attributes 23% of cloud compromises to voice phishing calls, and those calls are only credible because the caller already knows things they should not. The information came from precisely the four channels described above.
Three employee groups are profiled most often:
- Executives and their assistants, for payment authority and calendar access
- Help desk and IT support staff, for password and MFA reset authority
- Finance and treasury teams, for direct access to payment rails
What can an attacker actually assemble about your staff?
A useful exercise for any security team is to run the reconnaissance against your own organization before somebody else does. In practice an attacker can usually build, in under an hour and without touching your systems:
- Full names, job titles and reporting lines for an entire department
- Corporate email format, inferred from any single published address
- Internal tooling, named in job postings and support forum questions
- Personal mobile numbers, from breach corpora and data broker listings
- Absence windows, from out-of-office replies and public social posts
That profile is what turns a generic phishing email into a targeted one, and a cold call into a pretext the recipient believes. Threat monitoring surfaces this exposure continuously, so you find out what is available about your people before an attacker uses it.
Frequently Asked Questions
-
Yes. Company registries, press releases, conference speaker pages and job postings routinely expose names, roles and internal tooling. Employees are often profiled through the organization rather than through their own accounts.
-
The method is identical: collecting and correlating publicly available information about a person. The difference is intent. Doxxing publishes the result to cause harm. OSINT profiling keeps it private and uses it to make a later social engineering attempt credible.
-
By inventorying what is publicly exposed about high-risk roles, reducing what can be removed, and training the roles that cannot be hidden to expect contact that appears well informed. Executives, help desk staff and finance teams should be treated as named targets rather than as general awareness audiences.
See what an attacker can already find about your team
The public data behind doxxing is the same data that makes a phishing email or a vishing call convincing. Map your organization's exposure before somebody builds a pretext out of it. Protect your executives and their assistants with Executive Protection, and find out what is exposed about your people with Threat Monitoring.
