Doxxing: How to Get Your Personal Information Taken Down Fast

Doxxing is the deliberate publication of someone's private information — home address, phone number, workplace, family members, photographs — with the intent to expose, intimidate, or invite harassment. It has moved a long way from its origins in hacker feuds. Today it is used against journalists, moderators, small business owners, people on the wrong side of a viral post, and ordinary people who argued with a stranger online.

The frightening part is how little skill it requires. Almost nothing in a typical doxx is hacked. It is assembled from public records, data broker listings, old social media posts, and metadata that the target published themselves years ago without thinking about it.

How a Doxx Gets Assembled

Understanding the method matters, because it tells you which doors to close.

Data brokers

Companies like Whitepages, Spokeo and BeenVerified, and dozens of regional equivalents, compile addresses, phone numbers, relatives and property records into searchable profiles. A single search of your name and city often returns your current address, previous addresses, age, and the names of family members — free, in seconds.

Username reuse

If you use the same handle on Reddit, a gaming platform, a fitness app and a photography forum, anyone can link those accounts and merge the information each one leaks. One profile mentions your city, another your employer, a third posts a photo of your street.

Photo metadata and backgrounds

Photos can carry GPS coordinates in their EXIF data. Even stripped of metadata, a picture taken from a window, of a car with a visible plate, or of a package with a shipping label can pin a location precisely. Reverse image search does the rest.

Public records and registrations

Voter rolls, property deeds, business registrations, court filings and professional licences are public by design in many jurisdictions. Domain registration records expose an address unless privacy protection is enabled.

Breach data

Old breaches leak email addresses tied to phone numbers and physical addresses. These datasets are freely traded and searchable.

Social engineering

A friendly stranger asks where you went to school, what your first car was, which neighbourhood you grew up in. That is either the start of a doxx or the start of an account takeover, and often both.

Warning Signs You Are Being Targeted

• A sudden spike in follower requests, DMs, or comments from accounts with no history.
• Strangers referencing details you never posted publicly — your street, your employer, your children's school.
• Password reset emails you did not request, especially for email or phone accounts.
• Unexpected deliveries, food orders, or taxis arriving at your address.
• Contact from people claiming to be responding to an ad you never placed.
• Your name circulating in a small online community you are not part of.
• A call from your carrier about a SIM or number transfer request.

Escalation from online harassment to physical risk is real. Swatting — a false emergency call sending armed police to a home — usually follows a published address.

How to Reduce Your Exposure Before Anything Happens

1. Search yourself the way an attacker would. Google your full name in quotes, your name plus your city, your name plus your employer, your usernames, your phone number and your email address. Do it in a private window. Write down every result that exposes something you would not hand to a stranger.
2. Opt out of data brokers. Each major broker has an opt-out page — tedious, but effective. Prioritise the ones that appear on the first page of results for your name. Expect to repeat this annually; profiles regenerate from fresh public records.
3. Separate your identities. Use different usernames for different contexts. A single reused handle is the thread that lets someone pull your whole life together.
4. Lock down social profiles. Set old posts to friends-only in bulk (Facebook has a "Limit Past Posts" tool). Remove your hometown, employer, birthday and phone number from public view. Audit your tagged photos and your friends' public posts about you.
5. Strip photo metadata and think about backgrounds before posting. Avoid posting in real time from home; delay by a day.
6. Use a mail forwarding service or PO box for domain registrations, business filings and online orders where possible. Enable WHOIS privacy on any domain you own.
7. Get a secondary phone number for public-facing use — Google Voice, or a second SIM. Keep your real number for banking and 2FA only.
8. Harden the accounts that gatekeep everything else. Your email and your phone carrier are the two highest-value targets. Use a hardware key or an authenticator app rather than SMS, and add a port-out PIN with your carrier.
9. Check your voter registration and property record options. Some jurisdictions allow confidentiality programmes for people at risk, particularly survivors of domestic abuse.

If It Already Happened

Act in this order. Speed matters, because content spreads faster than it can be removed.

1. Document everything first. Screenshot the posts with URLs, usernames, timestamps and visible content. Save the page source or use an archiving service. Do this before reporting — content often disappears once reported, and you will need the evidence for police and platforms.
2. Do not engage. Responding confirms the target is real and paying attention, which is exactly the reward the harasser is seeking. Do not delete your own accounts either, in the first hours — you may need them to report and to communicate.
3. Report to the platform under the right policy. All major platforms prohibit publishing private information. Use the specific "private information" or "doxxing" report category rather than generic harassment, and include the URLs you captured. Google has a dedicated removal request form for personal information such as home addresses, phone numbers and identifying documents appearing in search results.
4. Secure your accounts immediately. Change passwords on email, banking and social accounts from a device you trust. Turn on the strongest available second factor. Check for unfamiliar recovery emails, phone numbers, forwarding rules and connected apps — an attacker who has your address may also be attempting account takeover.
5. Call your bank and your phone carrier. Add a verbal password or PIN to both. Ask the carrier to lock number transfers.
6. Warn the people around you. Family, employer, and your children's school should know, especially if a swatting attempt is plausible. Some police departments allow you to register a note on your address explaining you are a harassment target — that note can change how an emergency call is handled.
7. File a police report even if you expect little action. A report number is required by many platforms for escalated removals, and it establishes a pattern if the harassment continues.
8. Consider a credit freeze if identity documents or a full date of birth were exposed.
9. Get support. Organisations such as the Cyber Civil Rights Initiative, along with national cybercrime reporting centres, offer practical guidance and, in some cases, direct advocacy with platforms.

The Bottom Line

Doxxing works because the raw material is already public and scattered across dozens of sources that were never designed to be cross-referenced. Nobody breaks into anything; they simply assemble what you and various institutions have left lying around.

That also means the defence is largely mechanical. Audit what is findable about you, remove yourself from the brokers, break the link between your usernames, and put real protection on your email and your phone number. If it has already happened, document before you report, secure the accounts that matter, and do not answer the people doing it. Removal takes persistence, but almost every major platform and search engine now has a process for exactly this — and using it properly is far more effective than arguing.