What is doxxing and why does it happen?

Through social networks, data breaches, and automated data analysis, private in­di­vid­u­als and public figures alike can quickly become targets for attackers. Criminals, online bullies, and others with defam­a­to­ry intent collect and publish highly personal in­for­ma­tion, causing serious harm. This practice is known as doxxing (sometimes spelled doxing). What does it mean, and why do per­pe­tra­tors resort to it?

What is doxxing? A clear de­f­i­n­i­tion of these cy­ber­at­tacks

In many cy­ber­at­tacks, hackers rely on technical expertise. Malware is developed, security vul­ner­a­bil­i­ties are exploited, and software-based attacks are carried out. These ac­tiv­i­ties typically require advanced IT and pro­gram­ming skills. Doxxing, by contrast, usually demands no such technical expertise. Instead, per­sis­tence, mo­ti­va­tion, and de­lib­er­ate malicious intent are the decisive factors.

Doxxing attacks typically unfold in two stages: data col­lec­tion and pub­li­ca­tion. First, attackers gather all available in­for­ma­tion about the victim. This may include home addresses, email addresses, phone numbers, names of family members, social media profiles, private pho­tographs, and in some cases even bank details. As varied as this data may be, the sources from which it is obtained are just as wide-ranging.

• Social media: People publish numerous photos and even highly personal in­for­ma­tion on publicly ac­ces­si­ble social media profiles.
• Websites: The legal notice on a website or a blog can contain detailed address in­for­ma­tion about in­di­vid­u­als and companies.
• Address and phone di­rec­to­ries: Databases with addresses and phone numbers can also be searched online.
• Hacked databases: Attackers hack cloud storage or databases that are actually secured and obtain sensitive in­for­ma­tion from them. Data hijacked this way can also be purchased by doxxing criminals on the dark web.
• Social en­gi­neer­ing: Criminals pose as trust­wor­thy people online and ma­nip­u­late victims and their family members into vol­un­tar­i­ly dis­clos­ing in­for­ma­tion.

Many doxxing attacks take place using only publicly available in­for­ma­tion. The harm to the victim is caused by bundling the data and the context in which it is published.

In the second stage, the collected in­for­ma­tion is published and dis­trib­uted as widely as possible. Attackers often create fake accounts on social media and upload the material to anonymous platforms. The aim is to encourage as many people as possible to share and further dis­sem­i­nate the in­for­ma­tion, am­pli­fy­ing the resulting harm. In many cases, the pub­li­ca­tion is ac­com­pa­nied by threats, which may then be taken up by other users and can extend beyond the online space.

Why do people get doxxed? Motives, targets, and con­se­quences

Doxxing is rarely used for extortion, as attackers are usually not motivated by financial gain. In many cases, the in­for­ma­tion they collect is not sensitive enough to be exploited for money in the first place. Instead, the primary goal is to inflict non-material harm on the victim. Common motives therefore include revenge, vigilante justice, and attacks on political opponents. As a result, those affected are often politi­cians, jour­nal­ists, or public figures who have taken a public stance on political issues. Personal conflicts can also escalate into doxxing, par­tic­u­lar­ly when the aim is to strip someone of their anonymity.

Hate is often the main driving force behind these attacks. Rather than seeking profit, per­pe­tra­tors aim to in­tim­i­date and harm their targets. Simply pub­lish­ing personal data creates sig­nif­i­cant pressure on victims, sig­nalling that they are being de­lib­er­ate­ly targeted by in­di­vid­u­als willing to resort to illegal methods. Attackers may also hope that others with similar views will take further action — ranging from threats and ha­rass­ment to swatting (provoking a police response at the victim’s home) or even acts of physical violence. At the very least, the intention is often to in­tim­i­date victims to the point where they withdraw from public life.

In addition, doxxing per­pe­tra­tors sometimes seek recog­ni­tion within their own circles. It is not uncommon for them — typically under a pseudonym — to boast about their actions and gain status within their community.

Emerging forms of doxxing using AI, deepfakes, and data trading

Modern doxxing attacks in­creas­ing­ly use automated and AI-powered tools. These can in­de­pen­dent­ly search, structure, and cross-link publicly available in­for­ma­tion. This makes it possible to compile personal data faster and on a larger scale than with tra­di­tion­al manual attacks.

Deepfake-related leaks are par­tic­u­lar­ly prob­lem­at­ic. In these cases, ar­ti­fi­cial in­tel­li­gence is used to create ma­nip­u­lat­ed content such as fake chat histories, screen­shots, audio record­ings, or videos. Because this material appears highly authentic, it can falsely suggest the existence of real and com­pro­mis­ing in­for­ma­tion. For those affected, it is often difficult to dis­tin­guish genuine data from de­lib­er­ate fab­ri­ca­tions — and by the time the deception is uncovered, sig­nif­i­cant rep­u­ta­tion­al damage may already have been done.

What role do data brokers play in doxxing?

Another important data source is so-called data brokers. These companies collect personal in­for­ma­tion from a wide range of sources, enrich it with ad­di­tion­al details, and sell it com­mer­cial­ly. Typical sources include customer loyalty programs, mobile apps, sweep­stakes, and publicly ac­ces­si­ble registers.

Even when this data is collected legally, it can be misused by attackers to refine doxxing attacks. When combined with freely available in­for­ma­tion, it allows a highly detailed profile of the affected person to be created, often revealing where they live, their pro­fes­sion­al en­vi­ron­ment, or their personal interests.

Examples of doxxing

In September 2025, when con­ser­v­a­tive activist Charlie Kirk was shot and killed while speaking at a uni­ver­si­ty event, a wide­spread online backlash quickly turned into a doxxing-style campaign targeting people who had crit­i­cized him or posted comments seen as in­sen­si­tive about his death. Far-right social media accounts and anonymous websites began pub­lish­ing names, photos, employers and other iden­ti­fy­ing details of critics and com­men­ta­tors. Educators, academics and other in­di­vid­u­als faced dis­ci­pli­nary action, sus­pen­sions, or even job losses after their personal data was cir­cu­lat­ed online, and many were subjected to intense ha­rass­ment and threats as their details spread widely on social platforms.

Another example involves activists as­so­ci­at­ed with the Anonymous col­lec­tive, who have at times been linked to hack­tivist actions that expose the personal data of perceived opponents. Rooted in online vig­i­lan­tism and political protest, some members view doxxing as a way to expose wrong­do­ing or pressure in­sti­tu­tions and in­di­vid­u­als they oppose. Because Anonymous is a loosely organized movement without formal lead­er­ship, such tactics are sometimes used for public shaming or in­tim­i­da­tion rather than for financial gain.

How can you protect yourself against doxxing?

In principle, any internet user can become a victim of a doxxing attack. People who par­tic­i­pate in political debates online or publicly express political views in blogs, videos, or social media posts are par­tic­u­lar­ly likely to attract hostility. During co­or­di­nat­ed ha­rass­ment or bullying campaigns, attackers may then escalate their actions and resort to doxxing.

Because victims are sometimes chosen at random, all internet users should limit the amount of personal in­for­ma­tion they share online and follow the principle of data min­i­miza­tion. The less sensitive data attackers can find, the fewer op­por­tu­ni­ties they have to cause harm.

If you do become a victim and the doxxing leads to threats or ha­rass­ment, you should contact law en­force­ment and file a report. In addition, you can reach out to the platforms where the in­for­ma­tion was published and request its removal. However, if you intend to report the incident, it’s best to first take screen­shots to preserve evidence.

How doxxing is regulated in Canada

In Canada, doxxing is addressed through existing criminal law rather than through a dedicated offence. Section 264 of the Criminal Code prohibits criminal ha­rass­ment. It covers conduct such as re­peat­ed­ly com­mu­ni­cat­ing with a person directly or in­di­rect­ly, mon­i­tor­ing their movements, besetting or watching the place where they live or work, or engaging in threat­en­ing conduct. The offence requires that the person acts without lawful authority, intends to harass or is reckless as to whether the person is harassed, and that the conduct could rea­son­ably cause the person to fear for their safety or that of someone they know. On in­dict­ment, it carries a maximum penalty of 10 years’ im­pris­on­ment.

Where the pub­li­ca­tion of personal data is ac­com­pa­nied by threats, section 264.1 of the Criminal Code on uttering threats may also apply. It makes it an offence to knowingly send or convey a threat to cause death or bodily harm to any person, pun­ish­able by up to five years’ im­pris­on­ment on in­dict­ment.

Privacy leg­is­la­tion plays a more limited role. The federal Personal In­for­ma­tion Pro­tec­tion and Elec­tron­ic Documents Act (PIPEDA) governs how private-sector or­ga­ni­za­tions collect, use, and disclose personal in­for­ma­tion in the course of com­mer­cial ac­tiv­i­ties. It does not apply to an in­di­vid­ual’s col­lec­tion, use, or dis­clo­sure of personal in­for­ma­tion strictly for personal purposes. Alberta, British Columbia, and Quebec have their own private-sector privacy laws that are con­sid­ered sub­stan­tial­ly similar.

For victims, it is generally advisable to preserve evidence, report the incident to local police, and use the platforms’ reporting pro­ce­dures to request removal.