You're Being Doxxed

The danger was never one fact. It is almost never one fact. What hurts you is the join — a username you reused on a forum a decade ago, tied to an email, tied to a breach you forgot you were in, tied to a photo with the street sign visible in the background, tied to a check-in that puts you home every Tuesday at seven. None of those is dangerous alone. Assembled, they are a dossier, and the craft of doxxing is nothing but the patient joining of scattered public pieces into a single picture of who you are and where you are soft.

So the work of defending against it is the inverse: break the joins. You will not vanish — that is the wrong goal and chasing it gets people more exposed, not less. What you do instead is make yourself expensive to assemble. Too fragmented to piece together cheaply, too boring to keep working on. That is the whole game, and it is mostly quiet, unglamorous, paperwork-shaped effort. The films would hate it.

First, the calm, because the panic is part of the attack

When you find out, the body floods. You want to post the denial, confront the account, explain yourself, fight. Do not. A doxx feeds on reaction, and your reaction is the second half of the payload. Every reply you fire off is more text, more emotion, more confirmation, more surface — and it tells whoever did this exactly which lever moved you, which means it works again.

Go cold for the duration. Breathe it down, four counts in and four out, until your thinking brain comes back online. Then make decisions on the evidence and not on the fear. The feeling is real and it is data about you; it is not data about how bad the situation actually is. You can feel all of it later, on your own time, where it costs nothing. Right now you have work to do.

Don't feed it

The single highest-value move in the first hours is to stop adding to the pile. No public statement. No arguing with anonymous accounts. No screenshots of the threats reposted "to raise awareness," which only widens the reach and hands them the engagement they were after. Silence starves it. A doxx that gets no reaction is a fire with no oxygen — it does not catch, and it does not spread, and the person behind it gets bored, because the boredom of the watcher is the thing you are outlasting.

Tell the people who need to know — a partner, an employer, anyone whose own exposure is now tangled with yours — quietly and directly. Document everything, because facts do not care about feelings and a clean record of what was posted, when, and where is the anchor you will need if this becomes a matter for a platform or the police. Screenshot for the file, not for the feed.

Lock the doors that are still open

While they assemble what is already out, you close the seams that let the next layer in. This is the boring, decisive part.

• Kill the linkage. The moment a throwaway account shares a phone number, a recovery email, or a reused password with your real name, the wall is down. So separate your identities deliberately and stop the crossover: unique passwords on every login through a manager, app-based or hardware two-factor instead of the SMS code a SIM swap steals, a recovery email that is not your everyday one. Reused passwords and shared recovery details are the seams an investigator — or a harasser — pulls first.
• De-list yourself. The data brokers and people-search sites are where home addresses come from, and most of them have an opt-out. It is tedious and there are dozens of them and they repopulate, so it is a recurring chore, not a one-time fix. Do it anyway; it is the supply chain for your home address.
• Strip your own files. Almost everything you upload carries hidden data — the device, the time, and on photos, by default, the exact coordinates the shot was taken at. Strip metadata before you post anything, ever. And read the image itself before it goes out: a reflection, a street sign, a plate, a logo in the background place you as surely as a tag.
• Audit the trail you volunteer. Loyalty programmes are profiling you for free. Cards are surveillance by design — every swipe a logged time and place. Lock down what privacy settings you have, prune the public profiles, and stop broadcasting the pattern: the gym at the same hour, the café check-in, the holiday posted from the beach instead of after you are home. Where it matters, cash breaks a trail that cards are built to record.

Break the pattern they already have

A doxx is not only what is published. It is the routine it reveals. The same departure time, the same route, the same cashpoint on the same evening — that predictability is the X drawn on your own map, and now someone else holds the pen. So you introduce variance. You cannot randomise a life into chaos; you have a job and a home and a school run. But you can deny a clean prediction. Vary the times by fifteen or thirty minutes. Keep two or three routes to each regular place and rotate them with no schedule. Change which entrance, which side of the building, which machine, which hour. Mind the gates — the gap between your door and your car, the lobby, the garage — and cross them with your eyes up and your phone in your pocket, because looking down in a transitional space is the cheapest gift you can hand a watcher.

And harden the fixed point. A home address out in the open changes the threat model for the building itself: cameras that show a system is running, a door that costs more than a few minutes to get through, lighting that erases the hiding spots, the simple signal that someone is paying attention. Most trouble is lazy and rational and goes looking for the easier target. Be the harder one.

You bought time; that was always the prize

Nothing here is a wall. Security is never a wall — it is a clock. You cannot un-publish what is out, and anyone patient and well-resourced enough will, in the end, assemble a picture. What every measure buys you is time and friction: slower to find, costlier to track, less reliable to profile, and dull enough that the effort stops being worth it. In a contest against someone with finite attention, expensive and boring is how you win.

They are building you out of the pieces you left in the open. You can't gather the spilt pieces back up — so make every new one cost them, break the threads between the ones they have, and outlast the patience of a person who was only ever in it for the reaction.

Identities kept vague, the specifics moved, the substance unchanged. This is how it actually works, and how you actually slow it.

— M.