What is Doxxing?

Doxxing comprises the unauthorized collection and public distribution of personally identifying information or private material for malicious purposes. Released data may include phone numbers, residential info, family/romantic relations, email addresses, Social Security numbers, passwords, financial details, medical records, professional affiliations, social media accounts, intimate images, text messages, or other material. Doxxing is often motivated by revenge or undertaken for monetary gain, with published records intended to embarrass, extort, or exploit a victim.

Doxxing: A Widespread Problem

Few forms of cyberattack feel more personal than a public invasion of privacy. Unfortunately, the Information Age has made privacy an increasingly rare commodity. Internet tools allow anyone with a connection to become an investigator and publisher. This expansive access to info and social media explains how so many have fallen prey to doxxing.

Nearly one-quarter of Americans know someone who has been doxxed, and we estimate that around 11 million adults have been victimized in doxxing attacks.

Note: Multiple responses allowed.

Doxxing can take different forms, depending on the perpetrator and the victim. Sometimes it happens in a social media post unmasking an anonymous commenter or an embarrassing revelation within a chat group. Occasionally, it involves citizen detectives taking the law into their own hands. In other instances, the attacks are more severe and dangerous – including identity theft, the non-consensual sharing of intimate images, or the potentially deadly practice known as “SWATting” (where doxxers report fictitious crimes, hoping to have a target's home raided by armed police).

Home and email addresses were the most common information leaked in doxxing attacks. Additionally, one-quarter of subjects had personal images published, while family members were also targeted in 20 percent of cases.

Documenting raw doxxing numbers doesn't tell the whole tale. We asked victims to explain more about the circumstances and results of their experiences.

What Causes Doxxing?

Doxxing attacks can happen to anyone at any time, sometimes seemingly striking at random. When we asked victims why they were targeted, their answers generally fell into five categories.

• Online fights: Many doxxing incidents start from heated internet arguments. Spats among rival gamers, within pop culture fandoms, on social media sites, and in the comments section of political news articles served as the provocation for retaliatory attacks. Victims believed that jealousy, trash-talking, and opposing views had triggered their doxxing, generating real offline problems out of seemingly harmless digital confrontations.
• Personal disputes: Several victims were targeted by family members, coworkers, and former friends because of conflicts that commenced in real life. Frequently, spurned suitors and lovers are the culprits in personal doxxing attacks. In some of these cases, doxxing served as a threat to demand affection or favors. Other times, intimate images were released as retribution following romantic rejection.
• Financial schemes: Numerous victims detailed being doxxed as part of financial scams. Some had succumbed to phishing attacks, and others had billing info leaked after purchases. Several stated that their credit information had been hacked from financial institutions or carelessly exposed by businesses and medical providers. In such instances, the goal was generally to siphon off funds, open unauthorized accounts, or resell the data to identity thieves.
• Discrimination: Some victims we talked to were targeted based on their gender, sexuality, race, or beliefs. In these instances, doxxing served as a method of cyberbullying to silence their voices or to embarrass and undermine activism. Some victims were women advocating for gender equality or people of color protesting a lack of diversity. This form of doxxing is increasingly becoming a political weapon aimed at quelling opposing opinions.
• Unknown reasons: About one in ten victims had no idea why, how, or by whom they had been doxxed. These attacks seemed random or unexplained, suggesting personal information might have been uncovered and shared without a specific target or reason.

Doxxing Consequences

Just as doxxing motivations differed widely, so did the severity of repercussions. Some victims reported minor annoyances and fielding a few prank calls. In contrast, others described how attacks had wreaked pervasive havoc.

The consequences mentioned most often by victims in our study included:

• Mental health issues – Respondents repeatedly mentioned that stress and anxiety as after-effects of doxxing. “I was up and down, swinging from manic to depressed,” said one victim. Several others expressed feeling violated. “Having my family affected was very upsetting,” said the target of a Facebook hack. One victim in our study even had to be hospitalized due to the mental health impacts of being doxxed.
• Financial impact – Those victimized by scams and identity theft often had money stolen. Perpetrators used stolen information to open fraudulent accounts, divert tax rebates, and even buy cars. Disputing unauthorized charges and recovering funds proved arduous and time-consuming. One victim battled for months to reclaim stolen money. Others described endless phone calls attempting to set the record straight. Some mentioned the difficulty of proving cases to the IRS, and several discussed the burden of locking down credit reports and having all ID and credit cards reissued.
• Damage to personal and professional reputations – Doxxers often slander targets with misinformation or by leaking embarrassing information and pictures. One victim said that their “professional image was ruined,” as another described, “being reprimanded by my boss and nearly losing my job due to doxxing.” Another shared that their intimate photos were leaked online. “My professors saw my photos. I was so ashamed I left college and it sent me into a downward spiral,” they said.
• Physical safety threats – Knowing that a malevolent actor possesses one’s personal information inspires security worries among doxxing victims. Additionally, once details are made public, follow-up threats can come from anyone. Many victims described feeling vulnerable, being harassed by phone, receiving menacing messages mentioning personal details, and even strangers showing up at their homes. “For over a year I received multiple threatening phone calls…including death threats,” a victim recalled. “At one point my home was visited and someone actually camped out in the barn behind my house.”

Given the array of long-lasting harm and great inconvenience caused by doxxing attacks, it's understandable that so many Americans live in fear of such incidents.

Doxxing Prevention and Concerns

The grave repercussions of doxxing attacks cast a large shadow of fear over many Americans. While four percent of the population has been doxxed, 93 percent are concerned it might happen to them. Nearly half of adults expressed moderate or extreme concern about the potential dangers of doxxing.

When asked about the specific doxxing aspects that haunted them most, nearly three-quarters of Americans listed compromised personal information as a primary concern. More than half also worried about threats to their safety resulting from doxxing attacks.

Note: Respondents could select up to three concerns.

Is Doxxing Illegal?

Given the grave impact of doxxing and the concerns people have about becoming victims, it would make sense for there to be laws to stop this harmful practice. However, only a few states, such as Maryland, Nevada, and Oregon, have laws that specifically outlaw doxxing. Though doxxing might not be illegal nationwide, the Social Media Victims Law Center said those who are doxxed may have some legal recourse if their information was illegally obtained or shared.

In 2024, Illinois became the latest state to enact legislation to protect people from doxxing. Other states, like California or Florida, have harassment and cyberbullying laws that could apply to doxxing situations. Though bills on doxxing have been introduced in Congress, no federal laws have been made yet.

Americans Are Motivated To Avoid Doxxing Attacks

Since there aren’t legal protections in every state, many Americans are motivated to protect themselves – 92 percent have taken affirmative steps to protect themselves against doxxing.

Nearly 75 percent of adults limit their sharing of personal information on the web to protect against the possibility of doxxing. About half have proactively increased online privacy and security settings while regularly updating passwords. Nearly 40 percent added security software, monitored their data across the internet, or used aliases when logging on. Eighty-three percent of respondents employ two or more of these measures.

These safety measures reflect many of the best practices prescribed by online security guidelines. We assembled expert advice further elaborating on these steps so you can protect yourself against doxxing.

How To Protect Yourself Against Doxxing

1) Be discerning with how you share personal information. Social media and business networking sites encourage users to share wide-ranging personal info. These details may aid in the search for old friends or new employment but also help doxxers uncover private data and steal identities. Every personal fact (hometown, schools, family members, employment) supplies hackers with another piece of one's biographical puzzle, so consider whether each needs to be shared.

2) Secure all online accounts. Every online profile is a vulnerability that doxxers may exploit. Enable two-factor authentication wherever possible, in conjunction with unique complex passwords that are changed whenever prompted. Limit the visibility of your profiles by using more restrictive privacy settings. Also, be mindful of location-sharing or geo-tagging features that may reveal your residence or workplace.

3) Secure internet connections. Using virtual private networks (VPNs) and private browsers to access the web places additional security layers between you and possible doxxers. VPNs are very affordable, and most mainstream browsers already include “private” or “incognito” options for surfing.

4) Understand disguised security threats. Many doxxing victims surrender their critical information without ever being aware. Social engineering attacks, including spoofing, “phishing” and “smishing” schemes, can dupe users into unknowingly disclosing data or passwords. Never respond to email or text requests for passwords or personal info, even if they appear to be from legitimate providers. Always initiate a secure, trusted connection with financial institutions and other critical services rather than clicking links or downloading unverified files.

5) Monitor your information. Regularly assess the public footprint of your personal data. Beyond searching your name to ascertain available facts, consider enlisting an identity protection service for more vigilant reporting (including dark web surveillance and credit monitoring). Specific browsers and password managers will also alert users when outside parties try their logins.

6) Use judgment when debating on public forums. The internet is a fantastic tool that allows individuals with similar interests to connect from afar and share personal opinions. Sometimes, online discussions go beyond healthy debates and devolve into ugly disputes. Before participating in such “flame wars”, assess the risk of real-world repercussions like doxxing. Choose civil forums with solid reputations and competent moderators. Also, consider only participating under aliases registered through burner email accounts.

7) Respond immediately and report threats. Quickly isolate the issue when presented with evidence of doxxing or identity theft. Change all passwords, scrutinize/cancel credit cards, and report suspicions or questionable activity to financial institutions and law enforcement agencies. Identity theft frauds are criminal offenses, and some states are helping victims fight back by permitting civil actions against doxxers.

Conclusion

One-quarter of Americans know someone who has been doxxed, and more than 90 percent are concerned about suffering the same fate. That fear is widespread because the impact of attacks is often devastating and long-lasting.

Doxxers who publish sensitive personal information damage their victims personally, professionally, and financially. Our research found people who were threatened, robbed, embarrassed, inconvenienced, and left with relationships altered forever.

There are certain precautions that all web surfers can employ to safeguard their info online. Thankfully, more than 90 percent of Americans rely on one or more of these measures.

With careful online hygiene bolstered by next-generation password-less security protocols and expanded legal protections, soon, the tables may turn on doxxers.

Our Data

In January 2024, SafeHome.org conducted an online poll of 1,003 adult American internet  users. They represented the U.S. population in terms of their genders, races, and ages. All participants were surveyed regarding their concerns about and exposure to online doxxing practices. Respondents who identified as victims of doxxing were invited to participate in a more detailed study about the circumstances, reactions, and repercussions related to their attacks.