You're minding your own business when you receive an alarming message from a friend or family member. Feeling concerned, you go online and see that your private data is being shared across social media pages and online forums by strangers. You wonder how your sensitive information was made available for public consumption and if you were the target of a doxxing attack.
Some people spell it doxed while others spell it doxxed — but whether you write dox or doxx — the meaning remains the same. According to Malwarebytes Labs, dox is an informal abbreviation of the word “documents." While dox describes the act of researching private data about a person or organization, doxing or doxxing is when a threat actor publishes some of your private data on the Internet. Here are some examples of personal information that can be doxxed:
- Home address
- Work address
- Home number
- Mobile number
- Financial data
- Criminal history
- Romantic history
Why is it called doxxing?
Early computer hackers were apparently the first to use the term dox as short for the word documents. And in the 1990s, users on a discussion board called Usenet began revealing private information in response to arguments, in one of the earliest examples of doxxing. Interestingly, a Seattle court found the owner of a Usenet newsgroup guilty of sharing private information.
As a term, doxxing didn't gain traction until the late 2000s, when Internet users turned the term dox into a verb. In late 2008 it earned an entry in the Urban Dictionary according to The Atlantic. Three years later, it found its way into the Wiktionary.
The term’s immortalization in the Wiktionary may have something to do with Anonymous' doxxing of 7000 law enforcement officers in 2011 in retaliation to an investigation into the hacktivist group. It's fair to say that no other body has done more for the public awareness of the term than Anonymous. Over the years, the hackers collective has hit the KKK, Q-Anon supporters, and others with doxxing.
Can you go to jail for doxxing?
Is doxxing serious? Yes, it can turn someone's life upside down. Victims sometimes go into hiding. Doxxing survivors may face harassment, threats of physical violence, embarrassment, fear, anxiety, and depression.
But is the practice illegal? The answer to that is complicated. It’s usually not a crime to publish already publicly available information about a person. For example, it’s usually not illegal for you to tweet someone’s office phone number that you copied from their website. But it is illegal if you tweet a personal phone number that you stole from a device. In other words, doxxing is generally illegal if the doxer takes the data through illegal activity.
But even if you only dox someone with available information, you may still face civil suits or some of the following criminal charges:
- Invasion of privacy
The laws around doxxing are still evolving. While every case may not be illegal, doxxing can be unethical. People that don't face legal or civil charges for doxxing, may still be blocked by social media platforms and websites.
Can you doxx someone with their IP address?
Someone can usually only see your general geographical location, like your neighborhood, with your IP address. However, they can use your IP address alongside social engineering tactics to learn more about you. We recommend using Malwarebytes Privacy VPN to mask your IP address and help shield yourself from doxxing.
How can I tell if I’ve been doxxed?
You may hear from someone who knows you that your sensitive information is now public. To see if you’ve been doxxed, search your name on a search engine like Google and popular social media platforms like Facebook, Instagram, and Twitter to see what comes up. Should you see a collection of your personal information, you may be the victim of a doxxing attack.
What happens when you get doxxed?
After you get doxxed, you may receive a phone call or text from an acquaintance warning you that your private information is online. Either that or you may receive unwanted phone calls or texts from strangers who saw your number online. Strangers may also send mail to your home. In extreme and rare cases, you may face physical threats. You may also be a target of financial crimes and identity theft after doxxing.
What to do if you’ve been doxxed?
- Doxxing can be incredibly stressful. Get emotional support from people you trust.
- Take screenshots, including the date and URL of the offending pages, to collect evidence, even if the content involves something you regret.
- Report doxxing to the platforms publishing the data and ask them to remove it.
- Report the event to law enforcement.
- Freeze your credit reports, place fraud alerts, and deactivate your credit cards if someone posts your financial data.
- Keep an eye on your credit reports for any red flags.
- Change all your login credentials and enable two-factor authentication to protect your accounts.
- Set sophisticated passwords and use a password manager for help.
- Use an anti-malware tool to scan for privacy-invading malware like spyware, stalkerware, and keyloggers that can help a bad actor steal your personal information.
- Report any harassment to the authorities. Consider changing your phone number or address if the harassment is intolerable.
- Learn how to protect yourself from doxxing to help prevent potential attacks in the future.