What is doxxing and why does it happen?

Through social networks, data breaches, and automated data analysis, private individuals and public figures alike can quickly become targets for attackers. Criminals, online bullies, and others with defamatory intent collect and publish highly personal information, causing serious harm. This practice is known as doxxing (sometimes spelled doxing). What does it mean, and why do perpetrators resort to it?

What is doxxing? A clear definition of these cyberattacks

In many cyberattacks, hackers rely on technical expertise. Malware is developed, security vulnerabilities are exploited, and software-based attacks are carried out. These activities typically require advanced IT and programming skills. Doxxing, by contrast, usually demands no such technical expertise. Instead, persistence, motivation, and deliberate malicious intent are the decisive factors.

Doxxing attacks typically unfold in two stages: data collection and publication. First, attackers gather all available information about the victim. This may include home addresses, email addresses, phone numbers, names of family members, social media profiles, private photographs, and in some cases even bank details. As varied as this data may be, the sources from which it is obtained are just as wide-ranging.

• Social media: People publish numerous photos and even highly personal information on publicly accessible social media profiles.
• Websites: The legal notice on a website or a blog can contain detailed address information about individuals and companies.
• Address and phone directories: Databases with addresses and phone numbers can also be searched online.
• Hacked databases: Attackers hack cloud storage or databases that are actually secured and obtain sensitive information from them. Data hijacked this way can also be purchased by doxxing criminals on the dark web.
• Social engineering: Criminals pose as trustworthy people online and manipulate victims and their family members into voluntarily disclosing information.

Many doxxing attacks take place using only publicly available information. The harm to the victim is caused by bundling the data and the context in which it is published.

In the second stage, the collected information is published and distributed as widely as possible. Attackers often create fake accounts on social media and upload the material to anonymous platforms. The aim is to encourage as many people as possible to share and further disseminate the information, amplifying the resulting harm. In many cases, the publication is accompanied by threats, which may then be taken up by other users and can extend beyond the online space.

Why do people get doxxed? Motives, targets, and consequences

Doxxing is rarely used for extortion, as attackers are usually not motivated by financial gain. In many cases, the information they collect is not sensitive enough to be exploited for money in the first place. Instead, the primary goal is to inflict non-material harm on the victim. Common motives therefore include revenge, vigilante justice, and attacks on political opponents. As a result, those affected are often politicians, journalists, or public figures who have taken a public stance on political issues. Personal conflicts can also escalate into doxxing, particularly when the aim is to strip someone of their anonymity.

Hate is often the main driving force behind these attacks. Rather than seeking profit, perpetrators aim to intimidate and harm their targets. Simply publishing personal data creates significant pressure on victims, signalling that they are being deliberately targeted by individuals willing to resort to illegal methods. Attackers may also hope that others with similar views will take further action — ranging from threats and harassment to swatting (provoking a police response at the victim’s home) or even acts of physical violence. At the very least, the intention is often to intimidate victims to the point where they withdraw from public life.

In addition, doxxing perpetrators sometimes seek recognition within their own circles. It is not uncommon for them — typically under a pseudonym — to boast about their actions and gain status within their community.

Emerging forms of doxxing using AI, deepfakes, and data trading

Modern doxxing attacks increasingly use automated and AI-powered tools. These can independently search, structure, and cross-link publicly available information. This makes it possible to compile personal data faster and on a larger scale than with traditional manual attacks.

Deepfake-related leaks are particularly problematic. In these cases, artificial intelligence is used to create manipulated content such as fake chat histories, screenshots, audio recordings, or videos. Because this material appears highly authentic, it can falsely suggest the existence of real and compromising information. For those affected, it is often difficult to distinguish genuine data from deliberate fabrications — and by the time the deception is uncovered, significant reputational damage may already have been done.

What role do data brokers play in doxxing?

Another important data source is so-called data brokers. These companies collect personal information from a wide range of sources, enrich it with additional details, and sell it commercially. Typical sources include customer loyalty programs, mobile apps, sweepstakes, and publicly accessible registers.

Even when this data is collected legally, it can be misused by attackers to refine doxxing attacks. When combined with freely available information, it allows a highly detailed profile of the affected person to be created, often revealing where they live, their professional environment, or their personal interests.

Examples of doxxing

In September 2025, when conservative activist Charlie Kirk was shot and killed while speaking at a university event, a widespread online backlash quickly turned into a doxxing-style campaign targeting people who had criticised him or posted comments seen as insensitive about his death. Far-right social media accounts and anonymous websites began publishing names, photos, employers and other identifying details of critics and commentators. Educators, academics and other individuals faced disciplinary action, suspensions, or even job losses after their personal data was circulated online, and many were subjected to intense harassment and threats as their details spread widely on social platforms.

Another example involves activists associated with the Anonymous collective, who have at times been linked to hacktivist actions that expose the personal data of perceived opponents. Rooted in online vigilantism and political protest, some members view doxxing as a way to expose wrongdoing or pressure institutions and individuals they oppose. Because Anonymous is a loosely organised movement without formal leadership, such tactics are sometimes used for public shaming or intimidation rather than for financial gain.

How can you protect yourself against doxxing?

In principle, any internet user can become a victim of a doxxing attack. People who participate in political debates online or publicly express political views in blogs, videos, or social media posts are particularly likely to attract hostility. During coordinated harassment or bullying campaigns, attackers may then escalate their actions and resort to doxxing.

Because victims are sometimes chosen at random, all internet users should limit the amount of personal information they share online and follow the principle of data minimisation. The less sensitive data attackers can find, the fewer opportunities they have to cause harm.

If you do become a victim and the doxxing leads to threats or harassment, you should contact law enforcement and file a report. In addition, you can reach out to the platforms where the information was published and request its removal. However, if you intend to report the incident, it’s best to first take screenshots to preserve evidence.

How doxxing is regulated in Ireland

At the European level, lawmakers are increasingly responding to digital threats such as doxxing. The Digital Services Act (DSA) requires large online platforms to remove illegal content more quickly and to better protect those affected. This includes the unauthorised publication of personal data as well as targeted intimidation campaigns.

In addition, the NIS2 Directive strengthens cybersecurity across the EU. It is primarily aimed at companies and organisations with heightened security relevance and is intended to prevent data leaks and security incidents, which often form the basis of doxxing attacks.

In EU member states such as the Republic of Ireland, the DSA is enforced through national authorities (in Ireland, Coimisiún na Meán) and complemented by domestic laws on harassment and data protection. NIS2 has not yet been transposed into Irish law; the higher security standards for companies will apply once it is. For those affected, this means that platform operators are held to greater account.