CISA’s February 2026 guidance defines doxing as gathering someone’s PII or an organization’s sensitive information and releasing it publicly or using it maliciously, notes it can lead to extortion, social engineering and swatting, and lists protective steps for documents, data brokers and social media, plus response steps for victims.
\nCISA’s Protective Measures to Reduce Doxing on Critical Infrastructure Workers, dated as of February 2026, defines doxing as gathering an individual’s PII or an organization’s sensitive information from open sources or compromised materials and releasing it publicly or using it maliciously. It says doxing can lead to extortion, social engineering attacks and swatting, and that organization leaders may be targeted because of their position or stance on an issue.
\nCISA’s protective steps include secure storage and proper disposal of sensitive documents, regular audits of physical workspaces, opting out of data broker lists and requesting removal from public records websites, auditing personal and organizational social media accounts and their privacy and location tagging settings, and removing PII such as address, date of birth and phone number from profiles. It also advises being suspicious of unsolicited calls, visits or emails asking about employees, and enabling multifactor authentication for every account that offers it.
\nIf information is released, CISA says to determine what was exposed and how serious the threat is, report the incident to the organization’s security office, local law enforcement and the platforms involved, document it with screenshots, consider reporting to IC3 and CISA, work to remove the information, and watch for identity theft. If physical safety is a concern, it says to contact local law enforcement.
\nUse this for any organization whose leaders or staff could be targeted. CISA notes that laws against doxing vary by jurisdiction, so check local law when planning removal and response steps.
\nDSE recommends giving leaders and high-exposure staff a doxing prevention and response plan based on CISA’s guidance, including data-broker opt-outs and a single reporting path to the security office. Limit employee details in newsletters, directories and conference materials, brief reception and security staff on calls asking about employees, and coordinate home alarm, camera and police contact steps for anyone targeted.
\nReview the plan yearly with the people it covers, spot-check data broker sites for their information, and run a tabletop exercise on a doxing incident that includes the security office and local law enforcement contacts.
\nCISA — Protective Measures to Reduce Doxing on Critical Infrastructure Workers (as of February 2026). Reviewed October 18, 2026.
", "content_text": "CISA’s February 2026 guidance defines doxing as gathering someone’s PII or an organization’s sensitive information and releasing it publicly or using it maliciously, notes it can lead to extortion, social engineering and swatting, and lists protective steps for documents, data brokers and social media, plus response steps for victims.\nSource facts\nCISA’s Protective Measures to Reduce Doxing on Critical Infrastructure Workers, dated as of February 2026, defines doxing as gathering an individual’s PII or an organization’s sensitive information from open sources or compromised materials and releasing it publicly or using it maliciously. It says doxing can lead to extortion, social engineering attacks and swatting, and that organization leaders may be targeted because of their position or stance on an issue.\nCISA’s protective steps include secure storage and proper disposal of sensitive documents, regular audits of physical workspaces, opting out of data broker lists and requesting removal from public records websites, auditing personal and organizational social media accounts and their privacy and location tagging settings, and removing PII such as address, date of birth and phone number from profiles. It also advises being suspicious of unsolicited calls, visits or emails asking about employees, and enabling multifactor authentication for every account that offers it.\nIf information is released, CISA says to determine what was exposed and how serious the threat is, report the incident to the organization’s security office, local law enforcement and the platforms involved, document it with screenshots, consider reporting to IC3 and CISA, work to remove the information, and watch for identity theft. If physical safety is a concern, it says to contact local law enforcement.\nApplicability\nUse this for any organization whose leaders or staff could be targeted. CISA notes that laws against doxing vary by jurisdiction, so check local law when planning removal and response steps.\nDSE recommendation\nDSE recommends giving leaders and high-exposure staff a doxing prevention and response plan based on CISA’s guidance, including data-broker opt-outs and a single reporting path to the security office. Limit employee details in newsletters, directories and conference materials, brief reception and security staff on calls asking about employees, and coordinate home alarm, camera and police contact steps for anyone targeted.\nVerification\nReview the plan yearly with the people it covers, spot-check data broker sites for their information, and run a tabletop exercise on a doxing incident that includes the security office and local law enforcement contacts.\nOfficial reference\nCISA — Protective Measures to Reduce Doxing on Critical Infrastructure Workers (as of February 2026). Reviewed October 18, 2026.", "content_markdown": "CISA’s February 2026 guidance defines doxing as gathering someone’s PII or an organization’s sensitive information and releasing it publicly or using it maliciously, notes it can lead to extortion, social engineering and swatting, and lists protective steps for documents, data brokers and social media, plus response steps for victims.\n\n## Source facts\n\nCISA’s [Protective Measures to Reduce Doxing on Critical Infrastructure Workers](https://www.cisa.gov/sites/default/files/2026-04/Protective-Measures-to-Reduce-Doxing_508%20Compliant.pdf), dated as of February 2026, defines doxing as gathering an individual’s PII or an organization’s sensitive information from open sources or compromised materials and releasing it publicly or using it maliciously. It says doxing can lead to extortion, social engineering attacks and swatting, and that organization leaders may be targeted because of their position or stance on an issue.\n\nCISA’s protective steps include secure storage and proper disposal of sensitive documents, regular audits of physical workspaces, opting out of data broker lists and requesting removal from public records websites, auditing personal and organizational social media accounts and their privacy and location tagging settings, and removing PII such as address, date of birth and phone number from profiles. It also advises being suspicious of unsolicited calls, visits or emails asking about employees, and enabling multifactor authentication for every account that offers it.\n\nIf information is released, CISA says to determine what was exposed and how serious the threat is, report the incident to the organization’s security office, local law enforcement and the platforms involved, document it with screenshots, consider reporting to IC3 and CISA, work to remove the information, and watch for identity theft. If physical safety is a concern, it says to contact local law enforcement.\n\n## Applicability\n\nUse this for any organization whose leaders or staff could be targeted. CISA notes that laws against doxing vary by jurisdiction, so check local law when planning removal and response steps.\n\n## DSE recommendation\n\nDSE recommends giving leaders and high-exposure staff a doxing prevention and response plan based on CISA’s guidance, including data-broker opt-outs and a single reporting path to the security office. Limit employee details in newsletters, directories and conference materials, brief reception and security staff on calls asking about employees, and coordinate home alarm, camera and police contact steps for anyone targeted.\n\n## Verification\n\nReview the plan yearly with the people it covers, spot-check data broker sites for their information, and run a tabletop exercise on a doxing incident that includes the security office and local law enforcement contacts.\n\n## Official reference\n\n[CISA — Protective Measures to Reduce Doxing on Critical Infrastructure Workers (as of February 2026)](https://www.cisa.gov/sites/default/files/2026-04/Protective-Measures-to-Reduce-Doxing_508%20Compliant.pdf). Reviewed October 18, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/cisa-2026-doxing-protective-measures-executives-staff-data-brokers-response/", "url": "https://update.dsesecurity.com/updates/cisa-2026-doxing-protective-measures-executives-staff-data-brokers-response/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-18" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/cisa-2026-doxing-protective-measures-executives-staff-data-brokers-response/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Reduce doxing risk for leaders and staff with CISA’s 2026 measures for documents, data brokers and response", "item": "https://update.dsesecurity.com/updates/cisa-2026-doxing-protective-measures-executives-staff-data-brokers-response/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/cisa-2026-doxing-protective-measures-executives-staff-data-brokers-response/#article", "identifier": "https://update.dsesecurity.com/updates/cisa-2026-doxing-protective-measures-executives-staff-data-brokers-response/", "url": "https://update.dsesecurity.com/updates/cisa-2026-doxing-protective-measures-executives-staff-data-brokers-response/", "headline": "Reduce doxing risk for leaders and staff with CISA’s 2026 measures for documents, data brokers and response", "description": "CISA’s February 2026 guidance defines doxing as gathering someone’s PII or an organization’s sensitive information and releasing it publicly or using…", "abstract": "CISA’s February 2026 guidance defines doxing as gathering someone’s PII or an organization’s sensitive information and releasing it publicly or using it maliciously, notes it can lead to extortion, social engineering and swatting, and lists protective steps for documents, data brokers and social media, plus response steps for victims.", "articleBody": "CISA’s February 2026 guidance defines doxing as gathering someone’s PII or an organization’s sensitive information and releasing it publicly or using it maliciously, notes it can lead to extortion, social engineering and swatting, and lists protective steps for documents, data brokers and social media, plus response steps for victims.\nSource facts\nCISA’s Protective Measures to Reduce Doxing on Critical Infrastructure Workers, dated as of February 2026, defines doxing as gathering an individual’s PII or an organization’s sensitive information from open sources or compromised materials and releasing it publicly or using it maliciously. It says doxing can lead to extortion, social engineering attacks and swatting, and that organization leaders may be targeted because of their position or stance on an issue.\nCISA’s protective steps include secure storage and proper disposal of sensitive documents, regular audits of physical workspaces, opting out of data broker lists and requesting removal from public records websites, auditing personal and organizational social media accounts and their privacy and location tagging settings, and removing PII such as address, date of birth and phone number from profiles. It also advises being suspicious of unsolicited calls, visits or emails asking about employees, and enabling multifactor authentication for every account that offers it.\nIf information is released, CISA says to determine what was exposed and how serious the threat is, report the incident to the organization’s security office, local law enforcement and the platforms involved, document it with screenshots, consider reporting to IC3 and CISA, work to remove the information, and watch for identity theft. If physical safety is a concern, it says to contact local law enforcement.\nApplicability\nUse this for any organization whose leaders or staff could be targeted. CISA notes that laws against doxing vary by jurisdiction, so check local law when planning removal and response steps.\nDSE recommendation\nDSE recommends giving leaders and high-exposure staff a doxing prevention and response plan based on CISA’s guidance, including data-broker opt-outs and a single reporting path to the security office. Limit employee details in newsletters, directories and conference materials, brief reception and security staff on calls asking about employees, and coordinate home alarm, camera and police contact steps for anyone targeted.\nVerification\nReview the plan yearly with the people it covers, spot-check data broker sites for their information, and run a tabletop exercise on a doxing incident that includes the security office and local law enforcement contacts.\nOfficial reference\nCISA — Protective Measures to Reduce Doxing on Critical Infrastructure Workers (as of February 2026). Reviewed October 18, 2026.", "datePublished": "2026-10-18T21:01:34+00:00", "dateModified": "2026-10-18T22:22:09+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/cisa-2026-doxing-protective-measures-executives-staff-data-brokers-response/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/cisa-2026-doxing-protective-measures-executives-staff-data-brokers-response/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Reduce doxing risk for leaders and staff with CISA’s 2026 measures for documents, data brokers and response" }, "articleSection": [ "Business Continuity", "Cybersecurity" ], "keywords": [ "Business Continuity", "Cybersecurity", "Playbook", "Advisory priority" ], "genre": "Playbook", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" } ], "wordCount": 421, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "CISA — Protective Measures to Reduce Doxing on Critical Infrastructure Workers (as of February 2026)", "url": "https://www.cisa.gov/sites/default/files/2026-04/Protective-Measures-to-Reduce-Doxing_508%20Compliant.pdf" } } ] } }