What Is Doxing and How Does It Escalate to Physical Threats?

A Map of Six Front Doors

In May 2022, after a draft Supreme Court opinion overturning Roe v. Wade leaked, an activist group called ‘Ruth Sent Us’ posted a Google map pinning what the group identified as home addresses of six justices. Google removed the map. The addresses kept circulating, and weeks of protests followed at the justices’ homes.

On June 8, 2022, U.S. Marshals guarding Justice Brett Kavanaugh’s Maryland home spotted Nicholas Roske nearby. He carried a pistol, a knife, and zip ties. He told investigators he decided to kill the justice “after finding the Justice’s Montgomery County address on the Internet.” Prosecutors said he also saved a Google map pinning several justices’ home addresses. Roske pleaded guilty to attempted murder in April 2025.

Investigators never established where Roske found the address, and Ruth Sent Us denied responsibility. That uncertainty is the lesson. Once an address is published, nobody controls where it travels or who acts on it. I’ve spent my career in executive protection and protective intelligence, and I’ve watched that dynamic move from fringe forums to front doors.

What Is Doxing?

Doxing is the act of publicly exposing someone’s personal information without their consent, often with the intent to harass, intimidate, or cause harm. The information exposed can usually include a home address, phone numbers, family members’ names, vehicles, and daily routines. The term comes from early hacker culture, where “dropping docs” meant exposing a rival.

Today, most doxing takes no technical skill. Data brokers and people-search sites pull property records, voter files, court filings, and marketing data into profiles that are available for little or no cost Corporate filings and press coverage add the professional layer. Public social media posts from family members can reveal schedules and photos of the house.

The target list is growing. Recorded Future’s Insikt Group found that domestic violent extremists increasingly dox government officials, C-suite executives, and heads of institutions. Those doxes often follow a leader’s or company’s position on a contested issue, such as a geopolitical conflict, a diversity policy, or a political alignment. For an executive, an ordinary business decision can be the trigger.

How a Dox Becomes a Physical Threat

Escalation follows a pattern. In The Protector’s Edge, Fred Burton, Jonathan Wackrow, and I map it as the Hybrid Threat Targeting Cycle. Doxing sits at its center.

1. Reconnaissance. The actor builds the profile: address, family, vehicles, schedule. Data brokers can reduce weeks of manual research to hours. Roske searched online for the justices’ addresses and for ways to break into a home.
2. Exposure. The profile goes public on a forum, a Telegram channel, a paste site, or a social feed. Copies get archived and mirrored, so a takedown rarely removes it everywhere.
3. Amplification. Others share the post, add details, and attach a grievance. The target becomes a symbol. Each share lowers the bar for someone to act.
4. Physical Action. Someone acts on it: harassment at the home, surveillance, swatting, a physical approach, or an attack.
5. Converged Crisis. The incident hits physical security, legal, communications, the family, and the board at the same time.

Insikt’s research backs the link between stages two and four. People doxed by domestic violent extremists, the report concluded, are “at increased risk for follow-on physical and cyber threat activities.” Its case studies name harassment, stalking, protests, surveillance, and physical attacks among those risks.

Physical action doesn’t always mean violence. In 2025, federal judges reported hundreds of unsolicited pizza deliveries to their homes and their adult children’s homes, some sent in the name of Judge Esther Salas’s murdered son. The message was clear: we know where you live.

Most doxes never reach stage four of physical action. The cycle also doesn’t need a public post. In June 2025, Vance Boelter killed former Minnesota House Speaker Melissa Hortman and her husband and wounded a state senator and his wife. He never published anything. Investigators found a notebook listing 11 people-search sites he used to find addresses.  The same personal information used in doxing can also enable targeted violence without ever being publicly shared. For security teams, the underlying exposure is the vulnerability, regardless of whether the information is published.

Warning Signs and What to Do

Watch for these signals:

• Home address, family members’ names, or vehicle details appear in a post, a channel, or a paste site.
• Negative sentiment or threatening rhetoric targeting an executive or their organization increases” after a layoff, a price change, or a public stance.
• Unfamiliar vehicles near the residence, unexpected deliveries, or strangers calling family members.
• A swatting call or a “welfare check” nobody requested.

Then act before you need to:

• Shrink the exposure. Digital Exposure Reduction starts with removing principals and their families from data brokers and people-search sites. Keep doing it. Records repopulate.
• Include the family. Spouses and adult children are often the easiest route to a residence.
• Monitor the data. Watch for a principal’s personal information surfacing online. Threat language usually comes later.
• Plan the response now. Decide who calls law enforcement, who moves the family, who files takedowns, and who speaks publicly.
• Verify uniforms. Boelter wore a police uniform and claimed a welfare check. Teach every household to call the local office or 911 and confirm before opening the door to anyone claiming to be law enforcement or a government official.

Close the Gap

Doxing turns scattered public data into a targeting package. The distance between a post and a person at the door keeps shrinking as tools get faster and data gets cheaper. Every record removed is one less piece of information an attacker can exploit. Start with the home address. Reducing access to that information can make it harder for threat actors to move from digital reconnaissance to physical targeting.

Sources

• FBI affidavit, United States v. Nicholas John Roske, D. Md., June 2022.
• Insikt Group (Recorded Future), “Violent Extremists Dox Executives, Enabling Physical Threats,” March 27, 2024.
• National Review, “Pro-Abortion Group Publicizes Conservative Supreme Court Justices’ Home Addresses ahead of Planned Protests,” May 2022.
• Associated Press, “California man pleads guilty to attempted murder of Supreme Court Justice Kavanaugh,” April 8, 2025.
• Bloomberg Law, “Pizzas Sent to Judges’ Homes in Name of Judge’s Murdered Son,” April 15, 2025.
• The Record, reporting on the data broker list in the Boelter affidavit, June 2025.