How to protect your staff from doxxing

The most useful thing you can do is help each person shrink their exposure before anything happens: find where their home address and phone number are published, close off the links that lead there, and check again later. Then have a plan ready for the day someone is targeted.

Why staff get targeted

People are usually targeted because of something their organization did: a ruling, a story, a vote count, a treatment, a business decision. The person is the easiest target to reach. Their name is often public because of their job, and from a name, a people-search site can give out a home address and family members in a single search.

That means the risk isn’t only for executives. A clerk, a reporter on a single story or a nurse at a clinic can be just as exposed.

Who to start with

You probably can’t do everyone at once. Prioritize by:

Public visibility. Names on rulings, bylines, press releases, signage or social media.
Recent events. People connected to a controversial decision, story or incident.
History. Anyone who has already had threats or harassment.
Choice. People who ask. Make it easy to opt in.

Step 1: Find out what’s out there

Each person’s exposure is different. One has their address on a dozen people-search sites; another has an old forum account under a username they still use. Without looking, you can’t tell who’s at risk or what to fix.

You can have each person look themselves up, but it takes time, people don’t do it consistently, and they often miss the links that matter. A report per person gives everyone the same thorough check.

Step 2: Fix the biggest links first

For most people, the first fixes are:

Opt out of people-search listings that show their home address or phone number.
Close or clean up old accounts that link their name to a username, city or photo.
Change passwords and turn on two-step sign-in where a breach exposed them.
Ask Google to stop showing pages with their contact details, using its Results about you tool.

Give people time during work hours to do this. It’s more likely to get done.

Step 3: Respect their privacy

This is personal information, and staff need to trust the process.

Let each person see their own results privately. The organization doesn’t need to know where someone lives or which old accounts they have.
Track progress, not details. It’s enough to know who has finished and how exposure is trending across the team.
Make it optional and explain what is and isn’t shared.

Oko is built this way. Each member gets their own report. The organization sees a short summary of each one, like the exposure level and how many fixes are done, and never the details or the report itself. Once enough people have finished, it also sees totals across the team.

Step 4: Check again

People-search listings come back, people move, and new accounts appear. Plan to check again a few months after the first round, then regularly after that, and sooner for anyone in the news. See Why people-search listings come back.

Step 5: Have a plan for when it happens

Agree in advance:

Who staff should tell if they’re targeted, and how to reach them out of hours.
How to save evidence and report posts to platforms.
When to involve law enforcement, and who makes that call.
What support you offer: time off, temporary accommodation, legal advice, help with the platforms, support for family.
Who speaks publicly, so the targeted person doesn’t have to.

Share What to do if you’ve been doxxed with your staff as a starting point.

Legal protections

Depending on your sector and state, your staff may have legal rights to have their personal information taken off broker sites and public records. Judges, election officials, police and some health care workers are often covered. See Privacy protections for public servants.

How Oko helps

Oko gives each person a private report showing what a stranger could find about them, how they’d find it, and the fixes in order. Your organization buys credits and invites people, and sees progress across the team without seeing anyone’s details. See how it works for organizations.