Corporate doxxing: what it is and how to protect your company

Doxxing (or doxing) is the practice of investigating, gathering, and publishing a person's private or identifying information online without their consent. The main goal in exposing this personal data is to intimidate, humiliate, harass, or extort the victim.

The term comes from the English expression "dropping dox" (dropping documents), which originated in 1990s hacker culture to refer to revealing the real identity of an anonymous user. Today, this practice has moved beyond specialized forums and is frequently used on social media, public forums, and messaging platforms.

The seriousness of a doxing attack lies in the fact that aggressors track fragments of information scattered across the web in order to piece them together. By combining them, they manage to locate the affected person both digitally and in the physical world.

What kind of information is usually leaked

For the harassment to be effective, those who practice doxxing aim to expose the most sensitive and damaging data. The most common are:

• Personal contact details, such as mobile phone number or email address.
• The exact postal address of the current or former home.
• Information about the workplace, schedules, or the identity of coworkers.
• Personal connections, exposing the profiles or names of family and friends.
• Identity documents (such as a national ID or passport) and bank account numbers.
• Private photographs or image metadata that reveal exact locations.

How attackers get your data: the most common techniques

Attackers get your data to carry out doxxing by tracking your public digital footprint, extracting hidden metadata from your photographs, using social engineering techniques, or buying your information from companies that trade in it. In the vast majority of doxing cases, the aggressor doesn't need to hack your phone or computer; they simply collect and cross-reference the small traces of information you leave scattered around as you browse the internet.

To expose your identity, harassers use specific methods that combine patience with easily accessible tools.

Open source intelligence (OSINT) and social media tracking

The core method of doxxing involves digging through your public profiles and applying OSINT (Open Source Intelligence) techniques. Attackers examine your old posts in detail, the comments you leave on forums, your Instagram photos, or your LinkedIn connections.

By cross-referencing usernames or email addresses you repeat across different platforms, they quickly manage to link an anonymous account or a simple avatar to your real identity and your surroundings.

Buying files from data brokers

There are legal companies dedicated to collecting your consumption habits, public records, addresses, and phone numbers through massive databases.

Those who carry out a doxxing attack often pay small subscriptions to these data brokers to buy your complete personal file. This way, they effortlessly obtain your exact postal address, your address history, and even the names of your immediate relatives.

Metadata (EXIF) extraction from photographs and files

Every time you take a photo with your phone, the original file automatically stores hidden information called EXIF data.

If you upload that image to a forum, post it on a blog, or send it through platforms that don't compress files, the attacker can download it and extract its metadata. This instantly reveals the exact GPS coordinates where you took the photo, the precise time, and your phone model, giving away where you live, work, or spend your holidays.

Phishing and social engineering tactics

When public information isn't enough to carry out the doxing, aggressors turn to manipulation.

They might send you a fake email posing as your bank, an online store, or your internet provider so you confirm your personal details. Another common tactic in this kind of harassment is creating fake profiles on chats or online games to win your trust, getting you to voluntarily reveal personal or work-related details.

The impact of doxxing: real and reputational consequences

The impact of doxxing brings devastating consequences that range from anxiety attacks and fear for physical safety to losing your job or a high risk of financial fraud. Being a victim of this public exposure isn't just a problem that stays online; it's a deep crisis that destroys your digital reputation and moves virtual harassment right to your front door.

When aggressors decide to publish your data, the goal is to ruin your life in every area. The consequences of suffering doxing fall into three major risk blocks.

Psychological harm and violation of your personal environment

The first blow when you become a doxxing victim is the emotional impact. When you see your address or phone number published en masse on forums or social media, your sense of safety disappears completely.

• Extreme stress, insomnia, and paranoia from knowing that dozens of strangers are watching your every move.
• Phone harassment, receiving threats, or having emergency services sent to your home with false reports (a practice known as swatting).
• Exposure of your relatives, partners, or children, who become easy targets of doxing attacks as a way to hurt you more.

Destruction of professional and work reputation

Doxxing aims to sink you socially, so your professional career will always be one of the digital mob's main targets.

• Sudden dismissals due to the pressure attackers put on your company through calls, negative reviews, or mass emails.
• A permanent stain on your digital footprint, which scares off future recruiters who search your name on Google before hiring you.
• Loss of clients and a corporate brand crisis if you run your own business, since doxing destroys your credibility and the trust in your services.

Identity theft and financial fraud

When your personal documents are published online because of a doxxing attack, your information becomes a highly valuable resource for all kinds of cybercriminals.

• Taking out quick loans or opening accounts in your name using the leaked photos of your ID.
• Theft of your email or social media accounts, made possible because security questions are easy to answer with your life history exposed.
• Mass enrollment in paid subscriptions or cash-on-delivery shipments to your physical address to create an immediate financial hole.

Is doxxing a crime in Spain?

Yes, doxxing is a crime in Spain and is punishable by prison sentences of up to five years. Although the exact term doesn't appear literally in the law, this practice is prosecuted criminally by applying Article 197 of the Criminal Code for the discovery and disclosure of secrets, and it also constitutes a very serious breach of the General Data Protection Regulation (GDPR).

It doesn't matter if the aggressor argues that they found your phone number or address with a simple Google search. Using that data to expose your identity and trigger a digital lynching automatically crosses the line of legality.

The application of Article 197 of the Criminal Code

The Spanish legal framework comes down hard on those who violate another person's privacy without consent. When you're a victim of doxing, the law protects you by penalizing these actions:

• Seizing documents, messages, or emails to discover someone's secrets.
• Intercepting communications or using technical listening or recording devices to invade private life.
• Spreading, revealing, or handing over to third parties that data, images, or audio to seriously harm the victim.

If the attacker who doxes you spreads your personal information through social media, forums, or Telegram groups, prison sentences automatically increase because of the massive reach of the leak or if there's a profit motive.

The role of the AEPD and the breach of the GDPR

Beyond the criminal route, doxxing directly attacks European privacy regulations. Publishing your name, ID number, postal address, or workplace without your express permission is a direct breach of the General Data Protection Regulation.

In the face of a doxing attack, the Spanish Data Protection Agency (AEPD) plays a key role. This body has a priority channel that lets you request the urgent removal of sensitive content or photos, and it has the power to impose very severe financial fines on the people or platforms responsible for keeping the leak public.

The red line between public information and harassment

Many cybercriminals try to justify doxxing by hiding behind the fact that the data they published was already on the internet. However, the courts in Spain set a very clear limit on the use of this information.

Looking up someone's LinkedIn profile or reading their name in an official gazette is legal. What turns this action into a doxxing crime is the malicious handling of that data. Collecting disconnected traces, building a file about your life, and publishing it with the aim of inciting hatred, intimidation, or extortion breaks any expectation of privacy and gives you full right to take legal action.

How to prevent doxxing: 5 steps to protect your digital identity

To prevent doxxing and protect your digital identity, you should periodically audit your trail on the internet, restrict your profiles' privacy as much as possible, use alternative contact methods, delete inactive accounts, and hide your IP address. Minimizing the amount of personal information exposed online is the most effective preventive strategy to keep harassers from collecting your data and carrying out a doxing attack against you.

Since aggressors need to cross-reference multiple sources to locate you, cutting off their access to those basic traces neutralizes the threat from the start.

1. Do some egosurfing to audit your digital footprint

The first step to keep people from doxxing you is knowing what information about you is already public. Search for your name, surname, mobile number, and email on Google using quotation marks to get exact matches (for example, "name and surname").

If you find sensitive data published in business directories, old forums, or official gazettes, contact the website administrators to request immediate removal by exercising your right to erasure.

2. Apply strict privacy settings on social media

Attackers extract the vast majority of personal information by carefully analyzing your own profiles.

• Set your accounts to private so only your trusted circle can access your content.
• Hide your friends or followers lists so you don't expose the people around you.
• Turn off automatic geolocation on the photos you upload.
• Check which third-party apps have permission to read your social media data.

3. Use secondary email addresses and phone numbers

If you link the same email address to your bank account, your LinkedIn profile, and your hobby forums, you're making tracking enormously easy for those who practice doxing.

To protect your identity, create disposable or secondary email accounts when registering on non-essential platforms. Likewise, you can use services that generate temporary virtual phone numbers to receive verification codes without compromising your private line.

4. Delete or deactivate old accounts you no longer use

That blog from your teenage years, your profile on a forgotten forum platform, or an account on an online store where you haven't shopped in years are gold mines for a doxxing attack.

Run a mental review of all the services you've registered with over time and permanently close the inactive profiles. Reducing your exposure surface online removes back doors and weak points that a cybercriminal would use to connect your past with your present.

5. Browse the internet using a virtual private network (VPN)

Every time you visit a web page, comment on a blog, or enter a chat, your IP address gives away your approximate geographic location and your internet service provider.

Browsing through a VPN masks that real IP and encrypts your traffic, making it look like you're connecting from another city or even another country. This technical barrier is essential to avoid being tracked when you take part in anonymous communities or public debates, blocking the first step of any attempt to dox your physical identity.

I've been a victim of doxxing: immediate action protocol

If you've been a victim of doxxing, you need to apply an immediate crisis protocol that consists of not interacting with the attackers, gathering legally valid evidence, reporting the posts to the platforms to halt their spread, and filing a formal complaint with the authorities. Acting quickly and with a cool head is essential to stop the harassment and minimize the damage to your reputation.

When your data gets published online, time works against you and panic can lead you to make mistakes. Follow these four steps to regain control of the situation.

1. Cut off communication and don't give in to extortion

The first instinct when you suffer doxing is to ask the aggressors to delete the data or to try to defend yourself publicly on forums and social media. That's a mistake. Any response feeds the digital mob, confirms that the leaked information is real, and shows that they've managed to affect you.

Block direct communications, ignore the provocations, and above all, don't pay under any circumstances if the attack comes with financial blackmail.

2. Document all the evidence with legal validity

Before requesting the removal of your personal information, you need to secure the evidence. Saving simple screenshots from your phone may not be enough in a court case, since the aggressor's defense could claim they've been manipulated.

Use digital certification tools or web notarial records to capture the exact URLs, the threatening messages, the publication dates, and the profiles of those spreading your data. The more thorough the record of the doxxing attack, the more viable the future investigation will be.

3. Secure your accounts and report the content

Switch all your social media to private instantly. Change your main passwords and enable two-step verification to keep attackers from stealing your profiles by exploiting the leaked data.

Immediately afterward, use each platform's moderation tools (X, Instagram, Google, Reddit) to report the messages and photos, citing harassment and the publication of confidential information. The big tech companies have very strict policies against doxing users and tend to remove this content as a top priority.

4. File a complaint with the police authorities and the AEPD

Go in person to the Policía Nacional station or the Guardia Civil post with all the certified evidence you've collected. Filing a formal complaint allows the Cybercrime Unit to take on the investigation and urge internet providers to trace the harassers' real IP.

In parallel, if the doxxing includes intimate photos, medical data, or information that puts your safety at imminent risk, you should turn to the Priority Channel of the Spanish Data Protection Agency (AEPD). This body has the power to order the urgent precautionary removal of the content across the entire web.

How we at 202 Digital Reputation help you regain control

At 202 Digital Reputation we help you overcome a doxxing attack by removing your personal data from the internet, de-indexing the links on Google, and tracking the web using artificial intelligence to halt its spread. As an online reputation agency with over 15 years of experience, we apply fully legal and technological methods to tackle the crisis immediately, protect your brand, and restore your peace of mind.

We know that when your private information is exposed, time is the most critical factor. That's why our multidisciplinary team approaches neutralizing the doxing by working on three fronts at once.

Urgent content removal and de-indexing

When you suffer a data leak, the absolute priority is to erase that information from public view. Through our digital regulation department, we act directly against the platforms and the search engines.

• We file DMCA takedown requests to remove protected images or documents.
• We exercise the right to be forgotten to delete specific URLs and remove your name and surname from Google results.
• We carry out deep digital footprint cleanups to suppress old records and commercial data that make harassment easier.

Continuous monitoring through AI-powered social listening

Those who dedicate themselves to doxing often replicate the stolen information across multiple parallel forums or social networks to make it harder to delete. To keep the problem from resurfacing behind your back, we need to monitor the web without interruption.

Thanks to our social listening service powered by artificial intelligence, we track and analyze mentions of you in real time. This early-warning system lets us proactively detect whether your personal data is being shared on new platforms, blocking the leak before it goes viral again.

Legal services and repair of reputational damage

A serious doxxing attack doesn't just invade your private sphere; it can destroy your professional credibility or sink your company. If the situation has escalated, we offer comprehensive support so that those responsible face the consequences.

Our legal team carries out a digital forensic analysis and calculates the exact reputational damage you've suffered. We accompany you throughout the entire mediation and judicial process to confront online extortion or blackmail, while we execute a tailored brand crisis plan designed to rebuild, improve, and protect your digital identity over the long term.