Doxxing, also spelled doxing, is the practice of gathering private or sensitive information about a person or organization and releasing it publicly for a malicious purpose. CISA describes the goal as harming, harassing, stealing from or intimidating the victim. The term comes from “dropping docs.”

How it works

• Attackers combine public sources (OSINT), social media, data broker sites and leaked databases.
• Typical details include home addresses, phone numbers, family members, workplace and login names.
• The profile is posted on forums, paste sites or messaging channels, often with a call to target the person.
• Extortion groups may also threaten to dox employees or executives to push a company into paying.

Why it matters for dark web monitoring

Doxxing turns data leaks into personal risk. Information from an old data breach can be enough to locate a staff member or to impersonate them in social engineering attacks. MITRE ATT&CK suggests training staff on how to prevent and respond to doxing, as financially motivated groups use it to add pressure. Monitoring leak sources for the names and personal details of executives and key staff helps an organization react quickly, ask platforms to remove posts and protect the people involved.

Sources: CISA Insights: Mitigating the Impacts of Doxing on Critical Infrastructure, MITRE ATT&CK T1657: Financial Theft