Reduce doxing risk for leaders and staff with CISA’s 2026 measures for documents, data brokers and response

CISA’s February 2026 guidance defines doxing as gathering someone’s PII or an organization’s sensitive information and releasing it publicly or using it maliciously, notes it can lead to extortion, social engineering and swatting, and lists protective steps for documents, data brokers and social media, plus response steps for victims.

Source facts

CISA’s Protective Measures to Reduce Doxing on Critical Infrastructure Workers, dated as of February 2026, defines doxing as gathering an individual’s PII or an organization’s sensitive information from open sources or compromised materials and releasing it publicly or using it maliciously. It says doxing can lead to extortion, social engineering attacks and swatting, and that organization leaders may be targeted because of their position or stance on an issue.

CISA’s protective steps include secure storage and proper disposal of sensitive documents, regular audits of physical workspaces, opting out of data broker lists and requesting removal from public records websites, auditing personal and organizational social media accounts and their privacy and location tagging settings, and removing PII such as address, date of birth and phone number from profiles. It also advises being suspicious of unsolicited calls, visits or emails asking about employees, and enabling multifactor authentication for every account that offers it.

If information is released, CISA says to determine what was exposed and how serious the threat is, report the incident to the organization’s security office, local law enforcement and the platforms involved, document it with screenshots, consider reporting to IC3 and CISA, work to remove the information, and watch for identity theft. If physical safety is a concern, it says to contact local law enforcement.

Applicability

Use this for any organization whose leaders or staff could be targeted. CISA notes that laws against doxing vary by jurisdiction, so check local law when planning removal and response steps.

DSE recommendation

DSE recommends giving leaders and high-exposure staff a doxing prevention and response plan based on CISA’s guidance, including data-broker opt-outs and a single reporting path to the security office. Limit employee details in newsletters, directories and conference materials, brief reception and security staff on calls asking about employees, and coordinate home alarm, camera and police contact steps for anyone targeted.

Verification

Review the plan yearly with the people it covers, spot-check data broker sites for their information, and run a tabletop exercise on a doxing incident that includes the security office and local law enforcement contacts.

Official reference

CISA — Protective Measures to Reduce Doxing on Critical Infrastructure Workers (as of February 2026). Reviewed October 18, 2026.