Someone Is Selling My Personal Information Online: How to Investigate Data Exposure, Doxxing and the Misuse of Private Records

You search your name online and discover something you never expected to see: your phone number, email address, home address, date of birth or other personal information listed on an unfamiliar website.

Perhaps the information appears in a searchable database. Maybe someone has published it on a forum, included it in a social media post or offered it for sale through an online marketplace. In more serious situations, the information may be accompanied by threats, harassment or instructions encouraging others to contact you.

This type of exposure can create real risks. Personal information can be used for identity fraud, account takeover attempts, targeted phishing, impersonation and intimidation. When information is deliberately published to encourage harassment or threaten someone, the incident may also involve doxxing.

But discovering your details online is only the beginning of the investigation.

Where did the information come from? Was it obtained through a data breach, an exposed account, public records or unauthorised access? Is someone actively distributing it? Are the records accurate? And what evidence can establish how the exposure occurred?

This guide explains how to investigate suspected personal-data exposure, preserve digital evidence and take practical steps to reduce further risk.

What Is Doxxing and Personal-Data Exposure?

Doxxing generally refers to publishing or distributing someone’s identifying or private information without their consent, often with the intention of exposing, intimidating, harassing or putting pressure on them.

The information may include:

• Full names and previous names.
• Residential or business addresses.
• Personal telephone numbers.
• Email addresses.
• Dates of birth.
• Workplace or employment details.
• Family and relationship information.
• Personal photographs.
• Social media accounts.
• Private correspondence.
• Other identifying records.

Not every instance of personal information appearing online is necessarily doxxing. Some information may have been published lawfully, collected from public sources or exposed through an accidental disclosure.

The context matters. Investigators need to examine how the information was obtained, why it was published, whether it was shared without authorisation and whether the activity is connected to harassment, threats or fraud.

How Personal Information Ends Up Online

There are several ways personal information can become accessible to people who were never intended to receive it.

1. Data breaches

An organisation may experience a security incident that exposes customer, employee or account information.

Depending on the incident, exposed records may include names, email addresses, telephone numbers, account details or other personal information.

A data breach does not automatically mean that every exposed record will be published publicly. However, information obtained during a breach may later be misused, circulated or offered for sale.

2. Data brokers and people-search websites

Some websites collect and aggregate information from public records, commercial sources and other available datasets.

A person’s details may appear across several services, even if they never created an account with those websites.

The presence of information on a people-search website does not, by itself, prove criminal activity. The source, accuracy, collection practices and applicable privacy rules need to be considered.

3. Compromised email and social media accounts

An attacker who gains access to an account may obtain private messages, contact lists, photographs or other personal information.

Email accounts can be particularly important because they are often connected to password resets and other account-recovery processes.

If account compromise is suspected, an investigation should examine available login records, security notifications, account changes and relevant communications.

Cyb3rsect’s email forensics information provides related context for examining suspicious email activity.

4. Public social media information

People sometimes unintentionally reveal more information than they realise through public posts, photographs, biographies, location tags and comments.

Several separate details can be combined to create a more complete picture of someone’s identity, workplace, routine or personal relationships.

This is one reason privacy reviews should consider not only individual posts but also the information that can be assembled from multiple sources.

5. Unauthorised sharing by another person

Personal information may be shared by someone who originally received it through a private conversation, workplace relationship or other trusted interaction.

In these cases, the investigation may need to establish who had legitimate access to the information, when it was shared and whether there is evidence of subsequent distribution.

6. Exposed cloud storage and shared files

A file or folder may become accessible through an incorrect sharing setting, an exposed link or an account that has been accessed without permission.

The exposed material might include identity documents, photographs, contact lists or business records.

An investigation should examine the relevant account permissions and available activity records rather than assuming that every exposure resulted from an external attack.

Warning Signs That Your Personal Information May Be Misused

Personal-data exposure is not always immediately obvious. Sometimes the first indication is a suspicious message or an unexpected attempt to access an account.

Watch for:

• Your address or telephone number appearing on unfamiliar websites.
• Messages referencing private details you never shared publicly.
• Password-reset notifications you did not request.
• Unfamiliar login alerts.
• Fake accounts using your identity.
• Suspicious calls claiming to represent banks or government agencies.
• Threats referring to personal photographs or family information.
• Unusual attempts to contact your relatives or workplace.
• Messages demanding money in exchange for removing information.
• Reports that your details are being circulated or advertised online.

One warning sign does not establish how the information was obtained. Record what happened and look for supporting evidence before drawing conclusions.

How to Investigate Personal Information Being Sold or Published Online

A useful investigation should establish what information has been exposed, where it appeared, when it was observed and what evidence may explain its origin.

1. Record Every Location Where Your Information Appears

Start by documenting the websites, profiles and services where the information was found.

Record:

• The full URL.
• The website or platform name.
• The account or profile identifier.
• The date and time you accessed the page.
• The categories of personal information displayed.
• Any accompanying claims, threats or payment requests.
• Whether the information appears to be publicly accessible.

Preserve screenshots that show the relevant information and enough surrounding context to identify the page.

Avoid unnecessarily redistributing sensitive information. A record of the URL and a carefully stored screenshot may be sufficient for initial documentation.

2. Establish Whether the Information Is Accurate

Online records are not always reliable.

A website may display an outdated address, an incorrect telephone number or details belonging to another person with a similar name.

Compare the exposed information with records you know to be accurate. Note which details match, which are incorrect and which cannot be verified.

Do not assume that every record displayed under your name relates to you.

This distinction is important when investigating people-search websites, aggregated databases and alleged leaked records.

3. Preserve Original Evidence

Where possible, retain the original files, messages and records associated with the exposure.

Evidence may include:

• Screenshots of the published information.
• Original messages and emails.
• Account notifications.
• Downloaded files obtained lawfully.
• Platform report references.
• Relevant URLs and timestamps.
• Correspondence with website operators.
• Records of suspicious account activity.

Keep an evidence log showing when each item was collected and where it came from.

Avoid editing original files. If you need to redact personal details before sharing material with another party, preserve an unchanged original separately in a secure location.

For further guidance, see Cyb3rsect’s digital evidence preservation guide.

4. Examine Whether Accounts Were Compromised

If personal information appears alongside signs of suspicious account activity, investigate whether an email, social media or cloud account may have been accessed without authorisation.

Depending on the service and available records, relevant evidence may include:

• Unrecognised login sessions.
• Unexpected password resets.
• Changes to recovery email addresses or telephone numbers.
• New connected devices.
• Unfamiliar forwarding rules.
• Unexpected file-sharing activity.
• Messages sent without the account owner’s knowledge.

Secure affected accounts through their official recovery processes. Use a trusted device, update passwords and review multifactor authentication settings.

Where an incident may require forensic examination, consider how to preserve relevant records before making changes that could affect the available evidence.

5. Examine the Possible Source of the Exposure

An investigation may consider several possible sources:

• A known data breach.
• A compromised personal account.
• An exposed shared folder.
• Publicly accessible records.
• Unauthorised disclosure by someone with legitimate access.
• Information collected from multiple public sources.

The aim is to establish which explanations are supported by evidence.

For example, discovering your address on a website does not prove that your email account was hacked. Likewise, finding an exposed record does not establish who originally collected or published it.

Where a third-party organisation may be involved, preserve relevant notifications and correspondence. Non-public records held by a service provider may require an appropriate legal process to obtain.

6. Build a Timeline

A timeline can help connect the discovery of exposed information with other suspicious events.

Record when:

• You first noticed the information online.
• The information was reported to the platform.
• Suspicious calls or messages began.
• Account access alerts appeared.
• Passwords or recovery settings changed.
• Threats or demands were received.
• Other websites published the same information.

Use the timestamp shown by the source where available, and record the relevant time zone.

If the original publication date is unknown, distinguish it from the date you first observed the material.

7. Document the Findings and Limitations

A professional investigation should explain the material examined, the evidence collected, the methods used and the conclusions supported by the available information.

It should distinguish between:

• Verified personal information.
• Information that appears inaccurate or unconfirmed.
• Evidence of unauthorised access.
• Evidence of publication or distribution.
• Possible investigative leads.
• Questions that remain unresolved.

A report should not claim to identify the person responsible unless the evidence supports that conclusion.

Cyb3rsect’s guide to what a professional digital forensic report should contain explains the importance of clear documentation and transparent findings.

What to Do If Someone Is Threatening You With Your Personal Information

Some incidents involve direct threats. A person may claim to possess your address, private photographs, financial information or details about your family.

They may demand payment, threaten to publish additional information or attempt to pressure you into complying with their instructions.

If this happens:

1. Do not rush into paying or responding to the demand.
2. Preserve the messages, account details, URLs and payment instructions.
3. Avoid clicking unfamiliar links or downloading attachments.
4. Do not provide passwords, authentication codes or identity documents.
5. Secure affected accounts using official channels.
6. Report threats to the relevant platform and appropriate authorities.
7. Seek legal or victim-support advice where necessary.
8. If you believe you or someone else is in immediate danger, contact emergency services.

If the person demands cryptocurrency, preserve the wallet address and transaction instructions as evidence. Do not assume that a wallet address alone identifies its owner.

How to Reduce Further Exposure of Your Personal Information

Once an exposure has been identified, practical privacy and security measures can help reduce additional risks.

Secure your primary email account. Use a unique password and multifactor authentication. Review recovery details and active sessions.

Review social media visibility. Consider which personal details, photographs, workplace information and contact details are publicly accessible.

Check cloud storage permissions. Review shared links, folders, connected applications and unfamiliar devices.

Review people-search listings. Where a website provides a privacy, opt-out or removal process, check its requirements and submit a request if appropriate. Keep a record of the request and response.

Contact organisations holding exposed information. If you suspect a company or service has experienced a breach, use its official contact channel to request information about the incident and available protective measures.

Monitor accounts and financial activity. Watch for unexpected password resets, new account notifications and suspicious transactions.

Warn trusted contacts. If someone is impersonating you or contacting people using your details, let relevant contacts know how to verify genuine communications.

No single removal request or privacy setting can guarantee that information will disappear from the internet permanently. Copies, archived material and reposts may remain elsewhere.

Can Investigators Find Out Who Is Selling the Information?

This is a common question, particularly when personal information appears in an online listing or is being circulated through anonymous accounts.

The answer depends on the available evidence and the information that can lawfully be obtained.

An investigation may identify websites, accounts, publication patterns, related communications and possible connections between incidents.

Technical records may also help establish whether an account was accessed or a file was shared. However, the person who published information may not be the person who originally obtained it.

Some relevant records are held privately by website operators, hosting companies, telecommunications providers or online platforms. Access may require formal legal authority.

A careful investigation can identify evidence and investigative leads, but it cannot guarantee attribution or establish the identity of an anonymous seller from a public listing alone.

How Cyb3rsect Can Support a Personal-Data Exposure Investigation

Discovering that personal information is being published or offered for sale can leave individuals uncertain about the source, the extent of the exposure and the next steps.

Depending on the circumstances and the evidence lawfully available, a digital investigation may involve documenting exposed records, examining suspicious accounts and communications, reviewing relevant digital evidence and building a timeline of the incident.

Cyb3rsect focuses on digital forensics, cyber investigations and online fraud intelligence.

The appropriate scope depends on the incident, the available evidence and the questions that need to be answered. Findings should be based on verifiable information, with limitations clearly explained.

If your personal information has appeared online, you suspect unauthorised disclosure or you are dealing with suspected doxxing, visit Cyb3rsect to submit an enquiry describing the circumstances.

Final Thoughts: Your Personal Information Should Not Be Used Against You

Personal-data exposure can have consequences beyond an unwanted search result. It can lead to impersonation, harassment, targeted fraud and threats against individuals or their families.

The most useful response is to document where the information appeared, preserve the available evidence, secure affected accounts and report harmful activity through appropriate channels.

Do not assume that the first website displaying your information is the original source or that a particular person is responsible. Establish what can be verified and identify what requires further investigation.

Find the exposure. Preserve the evidence. Protect your identity.