Doxxing and Oversharing: How to Shrink What Strangers Can Find

Doxxing turns ordinary details into a weapon. The Cybersecurity and Infrastructure Security Agency (CISA) defines doxing as gathering a person's personally identifiable information, or an organization's sensitive information, "from open sources or compromised materials and releasing it publicly or using it for malicious purposes." CISA notes that anyone can become a victim. (You will see the word spelled both "doxing" and "doxxing"; they mean the same thing.)

What makes doxxing possible is rarely one big leak. It is usually many small, public pieces, such as a tagged photo, a property record or a people search listing, assembled by someone with bad intentions. That is also why prevention works: each piece you remove or lock down makes the puzzle harder to finish.

This guide covers where those pieces come from, how to reduce them, and what to do if you are targeted. If you are in immediate danger, call 911.

Know where the pieces come from

CISA's guidance lists common sources doxers draw on, including:

• social media posts
• property and court records
• wedding announcements and obituaries
• newsletters and public conferences
• web forums, blogs and discussion boards
• voter registration lists and real estate listing sites
• data brokers

The Federal Trade Commission (FTC) explains how one type of data broker, the people search site, builds its reports: by buying information from other data brokers, collecting information from public social media profiles, and compiling government public records. The FTC warns that someone with just one piece of information about you, like your name or phone number, could buy a report that includes details such as your current and previous addresses, your education and employment history, and the names and addresses of your family members.

Stop oversharing in everyday posts

Most oversharing is accidental. CISA's current doxing guidance says to assume that anyone can see personal information you share online. An older CISA tip sheet on publishing information online, now in the agency's archive, is more specific: it advises against posting information that could make you vulnerable, such as your address, phone number, email, or details of your schedule or routine, and notes that details about your hobbies, job, family and friends can give attackers enough to carry out a successful social engineering attack, where someone manipulates you or the people around you into revealing more.

A few habits address the most common slips:

• Post trip photos after you get home rather than while you are away.
• Check photos for house numbers, street signs, car plates, mail, badges and school logos before posting.
• Avoid announcing recurring routines, such as the same gym, at the same time, every day.
• Think twice before answering viral quiz posts that ask for a first pet, first car or hometown. The FTC warns that hackers try to guess security question answers, and that answers someone could find online are a poor choice.

Audit and tighten your social profiles

CISA recommends a regular social media audit. Its checklist for individuals includes:

1. Check security, privacy and location tagging settings on each profile.
2. Deactivate or delete profiles you no longer use.
3. Review followers, and unfollow or reject requests from anyone you don't know.
4. Remove personal details, such as your address, date of birth and phone number, from profiles.

CISA also suggests reviewing the apps and browser extensions on your devices and removing ones you don't need, since they can collect personal data, and doing your own searches periodically for unwanted pictures and information about you.

Opt out of people search sites

The FTC explains that most people search sites let you opt out, meaning ask them to stop selling your information. You can do it yourself, one site at a time, for free, or pay a service to do it for you. To do it yourself, the FTC suggests searching each site for your name, phone number or address, following its opt-out steps if you find a report about you, repeating on other sites, and checking back periodically. If you can't find an opt-out link, search the site's name with phrases like "opt out" or "remove my information." The FTC points to lists of these sites from the National Network to End Domestic Violence and the Minnesota House of Representatives.

Know the limits before you start. According to the FTC, your information may still appear in reports about relatives, neighbors or associates; it can reappear if your public records change; and opting out does not delete government public records. You may also be asked for information to verify your identity. If you consider a paid service, the FTC suggests asking how many sites it covers, whether it will report which sites it opted you out of, and how often it rescans.

Lock down the accounts a doxer would target

Doxxing and account takeovers often go together, because a compromised email or social account is a rich source of private information. CISA recommends strong, unique passwords for every account, a password manager to keep track of them, and multifactor authentication on every account that offers it. The FTC adds that an authenticator app or a security key is a more secure form of two-factor authentication than a code sent by text or email.

Be wary of unexpected calls, emails or visits from people asking questions about you or your coworkers. CISA advises suspicion here; it describes social engineering as an attacker using human interaction to obtain information. When a message claims to be from a company you deal with, the FTC advises contacting the company through a phone number or website you know is real rather than clicking a link.

If you've been doxxed

CISA lays out four steps for victims:

1. Understand the threat: figure out what information was exposed, how serious the threat is, and how it was obtained.
2. Report the incident to your local law enforcement agency and to any online platform where your information was posted, and to your employer's security office if you have one. Document what happened and take screenshots. CISA also suggests considering a report to the FBI's Internet Crime Complaint Center (IC3).
3. Remove the information by working with website administrators, and set your privacy settings to the most private options.
4. Monitor your safety: watch for signs of identity theft, monitor financial accounts, set up fraud alerts, and change your passwords. If you are concerned about your physical safety, contact local law enforcement.

Search results can be addressed too. Google says you can ask it to remove doxxing content when there is a URL showing your personal information along with explicit or implicit threats against you, or calls for others to harm or harass you, or a significant amount of your personal information gathered without a legitimate purpose. Removal from Google Search does not remove the page itself, so pursue the platform report as well. Our guide Searching Your Name: What Shows Up and What Google Will Remove explains Google's tools in more detail.

CISA notes that laws against doxing vary by jurisdiction, so check the rules where you live. An attorney can explain the options available to you.

Key takeaways

• Doxxing usually stitches together many small public details, so reducing each one helps.
• Keep addresses, schedules, routines and family details out of public posts and profiles.
• Audit privacy and location settings, delete unused profiles, and opt out of people search sites.
• Use unique passwords, a password manager and app-based or key-based two-factor authentication.
• If you're targeted, document everything, report to platforms and local police, and consider IC3.

Sources

• Cybersecurity and Infrastructure Security Agency, Protective Measures to Reduce Doxing on Critical Infrastructure Workers (February 2026)
• Cybersecurity and Infrastructure Security Agency, Guidelines for Publishing Information Online (February 1, 2021; archived content)
• Federal Trade Commission, What To Know About People Search Sites That Sell Your Information (July 2022)
• Federal Trade Commission, Protect Your Personal Information From Hackers and Scammers (November 2024)
• Google Search Help, Remove my private info from Google Search
• Federal Bureau of Investigation, Internet Crime Complaint Center (IC3)