Doxxing prevention and incident response

On 31 August the Electronic Frontier Foundation (EFF), a US digital rights group, published a two-part guide to doxxing, which it defines as "the deliberate disclosure of personal information" to bully, harass or intimidate someone. Part I is about prevention, Part II about response. The guide is written for US readers, but auditing your footprint and hardening accounts work anywhere.

Prevention starts with auditing yourself: check breach databases, list the sites where your usernames are registered (EFF notes the results may not be entirely accurate) and set social media accounts to private. EFF names data brokers as a frequent source of doxxing material and cites a study finding DIY removal requests more effective than paid services, though slower; paid services can suit those who would rather delegate.

Once an incident starts, keep a log of times, places, people and what you saw. To check forums where harassers gather, EFF recommends Tor Browser (a browser that hides where you connect from) and no engagement. Turn on two-factor authentication, consider shutting down targeted accounts and, where providers offer them, add security passwords or PINs to phone and bank accounts to block SIM swapping, where an attacker impersonates you to take over your number and then the accounts tied to it. Friends can share the monitoring, and Part II suggests a PACE plan (primary, alternate, contingency, escape/emergency).

Perspective

Doxxers piece together scraps from breach databases, data brokers and public records into a dossier. Some remedies exist only in the US: address confidentiality programmes in some states, which substitute a proxy address in public records, and California's DROP, which lets residents send one deletion request to all active data brokers. Following EFF's Tor Browser advice takes an extra step in mainland China, where GreatFire's tests show torproject.org blocked (checked 29 September). The Tor Project recommends on its support page that users there get the browser through GetTor and connect with bridges (unlisted entry points to the Tor network).

Hong Kong made doxxing a specific offence in October 2021, punishable by up to HK$1,000,000 and five years in prison where specified harm is caused. The Privacy Commissioner for Personal Data, head of the city's privacy regulator, can also serve cessation notices to have doxxing content removed.

In mainland China, under 2023 guidelines on cyber violence from the Supreme People's Court, the Supreme People's Procuratorate and the Ministry of Public Security, organising a "human flesh search" to illegally collect citizens' personal information and publish it to the public at large is punished as the crime of infringing citizens' personal information in serious cases. Victims who can show an infringement is under way or imminent, and that delay would cause irreparable harm, can also seek an injunction under Article 997 of the Civil Code.

In Taiwan, unlawfully collecting or using personal data in a way liable to cause damage can bring up to five years in prison under Article 41 of the Personal Data Protection Act, to which a fine of up to NT$1 million may be added. The offence requires intent to obtain an unlawful gain for oneself or a third party, or to damage another person's interests.

Any complaint needs evidence, so keep screenshots and links in the incident log from the first message. Going to the police is a judgement call: EFF writes that "for many, talking to law enforcement will only make things worse."

The first step today is to enter your email address at Have I Been Pwned, a breach search site, to see whether it appears in any known data breach. When we checked on 29 September the search was free, needed no account and the site was English-only. GreatFire's last test, on 9 February 2026, found it reachable from mainland China, and it has not been retested since. If your address appears, EFF lists changing the address or phone number as an option, while calling it "extremely inconvenient".