The news rarely comes from the executive. An assistant spots a post. Someone on the communications team notices a home address sitting in the replies under a viral thread. A spouse gets a strange phone call at the house. By the time anyone with authority hears about it, the information has usually been public for hours.
What happens over the next two days largely decides whether the doxxing fades out or turns into something worse. This is the sequence we use in practice. It isn’t legal advice, and every situation needs to be judged on its own facts, but the order of operations matters more than most people expect.
Hours 0 to 2: Confirm, capture, keep it small
The first job is to find out exactly what was posted, where, and by whom if the account is visible. Then preserve it before it disappears. Take screenshots that show the full URL, the date and the account name, and save copies of the pages themselves. Posts get deleted quickly once they draw attention, and a clean record matters if police or lawyers get involved later. This is where forensically sound collection pays for itself.
Next, keep the response group small: security, legal, communications and the executive’s chief of staff or assistant. Everyone else can be briefed later. Agree on one person who makes decisions and one channel for updates, because a doxxing incident spreads just as easily inside a company as it does outside one.
And don’t reply publicly. A statement, a denial or an angry repost from the executive tends to push the original post to a far larger audience.
Hours 2 to 6: Assess the threat, not just the post
Doxxing is the release of information. The real question is intent, and that is a protective intelligence problem rather than a PR problem. A few questions help separate noise from danger:
- Does the post include a call to action, such as telling people to “visit” the home?
- Is it on a forum or channel with a history of people acting offline?
- Does it mention the family, a school, a daily routine or an upcoming appearance?
- Is it tied to a live grievance, like layoffs, a lawsuit, a price increase or a political controversy?
- Are there direct threats in the post or the replies?
The answers set the level of response. An address dropped in an angry thread with no follow-up is serious, but it is not the same as a post naming the children’s school the day before a shareholder meeting.
Hours 6 to 24: Protect people and places
The residence. Brief household staff on what has happened and what to watch for. Check cameras, lighting, gates and access control. Depending on the assessment, temporary on-site coverage at the home may be the right call for the next several days.
The family. Tell the people who need to know, including schools where it makes sense. Adjust routines that have become predictable. Lock down family members’ social media accounts, since those are often the next thing people go looking for.
The schedule. Review every public appearance over the next week or two. Some can go ahead with added advance work. Some should move.
Law enforcement. Where there are threats, report them to the local police department or sheriff’s office with your evidence package. Having clean documentation ready makes that conversation far more productive.
Accounts and assistants. Reset passwords on personal email, turn on strong multi-factor authentication, and warn banks and the executive assistant about pretext calls. Doxxing often comes before an attempt at social engineering, because the attacker now has enough personal detail to sound convincing.
Hours 24 to 48: Takedowns and monitoring
With people protected, the focus shifts to shrinking the exposure. Report the posts under each platform’s rules on sharing private information, which most major platforms have. Send removal requests to the people-search sites that were the likely source of the address, and request removal of search results that show it.
At the same time, set up monitoring. Doxxed information tends to get reposted on smaller forums and mirror sites after the original comes down, and escalation language usually shows up there first. Brief front-desk and switchboard staff too, because unusual calls and visitors to the office are common in the days that follow.
Where organizations usually go wrong
We see the same few mistakes again and again. Companies treat doxxing as a communications issue and hand it to PR alone. They put all their effort into takedowns and forget that anyone who already copied the address still has it. They stand everything down after two days, even though the risk often runs for weeks, especially around the event that caused the anger in the first place. And most of them had no plan at all until the morning it happened.
After 48 hours: Build the plan you wish you’d had
Once things settle, look back honestly. How did the address get out? How long did it take to find out? Who made decisions, and was that clear? Then fold the answers into a written doxxing response plan that sits inside the executive protection program, with the digital footprint reduced ahead of time so there is less to leak next time.
How Delta helps
Delta Strategic Solutions brings protective intelligence, executive protection, investigations and digital forensics under one team, which is exactly what a doxxing incident calls for. We respond for executives and families across New York City, Long Island and Westchester from our Uniondale office, and we support clients in Florida and other major U.S. markets. You can see how we’ve handled targeted threats against senior leaders in our case studies.
