Your home address may already exist in a county database. Your employer may be listed on LinkedIn. An old wedding announcement can identify your spouse, and a photograph from a school event can reveal where your children spend their mornings.
Individually, those details may have sat online for years without causing trouble. Doxxing begins when someone gathers them, connects them to a specific person and publishes the package for an audience that has a reason to use it against them.
Doxxing Does Not Require Hacking
The popular image of a doxxer is somebody breaking into a private database and dumping stolen files online. Plenty of modern cases require nothing that sophisticated.
The Cybersecurity and Infrastructure Security Agency describes doxxing as collecting personally identifiable or sensitive information from open sources or compromised material and releasing it publicly or using it maliciously.
Open sources are the part people tend to underestimate.
Property records can connect a name to a home. Corporate websites reveal jobs. Social accounts expose relatives, birthdays and routines. People-search services combine records from multiple databases. A photograph can contain a street sign, license plate or school uniform that its owner barely noticed when posting it.
Someone searching patiently can build a remarkably detailed profile without stealing a password.
Even the word comes from an older version of the same practice. Cornell Law School’s Legal Information Institute traces “doxxing” to the 1990s hacker expression “dropping dox,” meaning the release of documents that exposed somebody’s identity.
Social media changed the scale. A dossier that once circulated among a small group can now reach tens of thousands of people in an afternoon.
The Difference Is What the Information Is Being Used For
Imagine that your address appears in a searchable property record. Few people have a reason to look for it, and fewer still will stumble across it.
Now put the same address beside your photograph, phone number and workplace in a viral post accusing you of something inflammatory. Add an audience already angry with you.
The underlying address did not change. Its function did.
That difference sits at the center of one of the clearest doxxing prosecutions of 2026.
In May, Kyle Andrew Edwards of North Carolina pleaded guilty in federal court after publishing the home address of a U.S. Supreme Court justice. Prosecutors said his posts appeared alongside threats and statements encouraging violence against members of the court.
The address was important to the case because prosecutors said Edwards knowingly published restricted personal information with the intent to threaten, intimidate or facilitate violence. The prosecution was therefore about far more than somebody discovering where a public official lived.
A second guilty plea followed in California in June. Gregory John Curcio admitted publishing the home address of an ICE attorney and directing other people to “swat” her, according to the U.S. Attorney’s Office in Los Angeles.
Swatting uses a false emergency report to send armed police to another person’s location. Once an address becomes part of that scheme, the distance between an online post and physical danger becomes very short.
Doxxing Is Not One Federal Crime
The word itself can create a false impression that American law contains a single offense called doxxing that applies whenever somebody publishes another person’s details.
It does not.
Cornell’s legal reference notes that federal law protects certain officials and employees from publication of restricted personal information under specific circumstances. Cyberstalking, threats and other statutes can also apply. State laws differ considerably.
A Virginia case this year shows how much the details matter.
Activist Barbara Wien came under investigation after material containing White House adviser Stephen Miller’s home address was distributed during protests near his Virginia residence. Arlington and Falls Church Commonwealth’s Attorney Parisa Dehghani-Tafti ultimately declined to bring state charges.
According to CBS News, prosecutors concluded that the evidence did not support charges under Virginia law for using identifying information to coerce, intimidate or harass.
The result does not create a general permission to publish somebody’s address. It illustrates why the surrounding conduct, applicable statute and evidence of intent matter when a doxxing accusation reaches a courtroom.
A New Columbia Lawsuit Shows How Doxxing Can Work Without a Home Address
Home addresses receive much of the attention because the physical danger is easy to grasp. Doxxing campaigns can work with other identifiers.
Former Columbia University graduate student Mahmoud Khalil and other plaintiffs filed a federal lawsuit on September 14 accusing the university of failing to protect pro-Palestinian students from harassment and doxxing.
The Associated Press reported that the complaint alleges Columbia showed deliberate indifference as students were publicly identified and targeted over their activism. The lawsuit also contains broader allegations of discrimination and retaliation. Columbia has not accepted those allegations and said it remains committed to providing a safe and inclusive campus.
The case is still litigation, not a finding that Columbia committed the acts alleged in the complaint.
Its relevance to doxxing is broader. A campaign does not need somebody’s street address to affect their life. Publishing a legal name beside a photograph, university affiliation, employer or family connection can give strangers enough information to continue searching on their own.
Once that process begins, the original post is no longer the whole story. Copies move through screenshots, group chats, reposts and archives that the first publisher may have no ability to retrieve.
The Internet Has Made Small Clues Much More Valuable
Years ago, finding somebody’s workplace, relatives and recent locations could require several different records searches. Search engines, social networks and data brokers have compressed much of that work into minutes.
CISA specifically warns that publicly shared information can reveal relationships, opinions and places of interest that another person may later exploit. Data brokers add another layer by collecting information from multiple sources and selling or displaying profiles built from it.
Southwest Journal has previously examined the way social platforms distort identity and behavior online. Doxxing exposes a different weakness in the same system. Accounts created to make people easier to find, contact and understand also leave clues for people whose interest is hostile.
The amount of information required can be surprisingly small. A first and last name plus a city might locate a property record. A professional biography supplies an employer. A tagged photograph identifies a relative. One public post mentioning a favorite coffee shop starts to establish a routine.
No single clue has to look dangerous when it is posted.
What To Do When Your Information Starts Circulating?
The first hours are very important because a post can disappear from its original location and continue circulating elsewhere.
Save screenshots that show the account, date, URL and surrounding messages before reporting the material. Record which pieces of information were exposed. Contact the platform hosting the post and ask for removal under its privacy or harassment rules.
Physical threats, publication of an address alongside violent language or signs that somebody intends to come to a home or workplace require a different response. Contact law enforcement rather than continuing the argument online.
Account security also deserves attention even when the exposed information came from public records. Change passwords if an account may have been compromised, turn on multi-factor authentication and review recovery email addresses and phone numbers.
Then search for yourself the way a stranger would.
Your name, phone number, usernames, employer and city can reveal what a determined person can assemble without ever contacting you. Old profiles that no longer serve a purpose can be deleted or made private. Location tags and photographs deserve a second look, particularly when they expose children, homes or regular routines.
Doxxing works because the internet stores fragments of a life in different places and makes them easy to reconnect. The most dangerous post is sometimes not the one containing a secret. It is the one that collects information everybody could technically find and hands it to people who suddenly have a reason to look.
