When an executive's home address, family details or personal phone number are published, the first risk is to a person's physical safety, and most security incident playbooks are not built for that. Doxxing of senior staff follows layoffs, controversial decisions, activist campaigns, extortion and ransomware leak sites, and the same exposed details fuel help desk impersonation, deepfake fraud and account takeover against the organisation. Responding well needs security, HR, legal, communications and sometimes the police to work together, with the affected person and their family at the centre. This playbook template gives [Organisation] a ready-to-adapt process for assessing threat, protecting people, getting content removed, closing the account and fraud routes the exposure opens, and supporting the people involved. It is protective guidance only. It is for corporate security, HR, legal and executive support teams. For prevention see the Executive Protection and Digital Footprint Guide.
How to use this template
- Adopt it as a joint security and HR procedure, referenced from [Organisation]'s incident response plan and duty-of-care policy. See the Incident Response Plan Template.
- Safety overrides everything. Any credible threat of violence goes to the police immediately (section 3.1), before any other step.
- The affected person decides with you. Removal requests, police reports and family involvement need their informed consent; record it.
- Apply it beyond executives where risk warrants: board members, staff in visible roles, security and HR staff themselves, and their families.
- Replace every [placeholder], keep case records confidential with access limited to the case team, and review the template yearly.
1. Scope and triggers
1.1 This playbook covers publication or sale of personal information about [Organisation] executives and other covered people, or their families, where the publication is hostile, unauthorised or creates risk. Personal information includes home address and location, personal phone and email, family members and schools, vehicle details, identity document numbers, financial details and private images.
1.2 Triggers include:
- Posts, paste sites or forums publishing a covered person's personal details, or threats to do so.
- Personal data of executives appearing in a ransomware leak or extortion message. See the Extortion Email Playbook.
- Unexpected deliveries, visitors, calls to family members or emergency service hoaxes at a home address.
- A spike in phishing, smishing, vishing or help desk contact using personal details of a covered person.
- Reports from the person, their family, the executive assistant team, or a monitoring service.
1.3 Typical follow-on threats to record in the case (MITRE ATT&CK, for organisational risk context only): T1589 Gather Victim Identity Information, T1598 Phishing for Information and T1566.004 Spearphishing Voice.
2. Roles and contacts
| Role | Responsibility | Named contact |
|---|---|---|
| Case lead (corporate security) | Runs the case, threat assessment, coordination with police | [Name, out-of-band number] |
| HR lead | Wellbeing, duty of care, family support, leave and work adjustments; leads if the source may be an employee | [Name] |
| Legal counsel | Removal notices, data protection requests, legal action, evidence standards | [Name or firm] |
| Cyber security and identity | Account protection, help desk alerts, fraud controls, monitoring | [Name] |
| Communications | Internal and external statements, media enquiries | [Name] |
| Executive support | Diaries, travel, assistant team briefings | [Name] |
| External providers | Protective security, removal services, counselling | [Providers and contract references] |
| Police | Emergency response and investigation | [Emergency number; local liaison contact] |
3. Detection and triage
3.1 Immediate safety check (within 1 hour): is there a threat of violence, a stated intent to visit, a home address combined with hostile content, or children's details? If yes, the case lead calls the police, informs the person and agrees immediate protective steps (for example staying elsewhere, home security attendance). Record the time and reference number.
3.2 Preserve evidence before requesting removal: capture the full page with URL, date and time, the poster's account name and profile, and any threats, using screenshots and saved copies stored in the case file. Do not engage with the poster. See the Evidence Handling and Chain of Custody Guide.
3.3 Assess the exposure:
| Factor | Lower risk | Higher risk |
|---|---|---|
| Information exposed | Work contact details already public | Home address, family, children's schools, daily routine, identity numbers |
| Context | Neutral listing or old data broker page | Hostile campaign, calls to action, threats, coordinated posting |
| Reach | Single low-traffic page | Large forum, trending topic, leak site |
| Actor | Unknown, opportunistic | Known fixated individual, organised group, extortion actor |
| Corroboration | No other activity | Physical incidents, calls to family, linked phishing |
3.4 Classify: [Critical] any threat to safety or children's details; [High] home address or family details in a hostile context; [Medium] personal contact details exposed without threats; [Low] old or neutral listings. Severity sets the review cadence in section 6.
3.5 Consider the source. If the data could only have come from HR, payroll or other internal systems, open a parallel data breach investigation and assess notification duties. See the Insider Data Theft Response Playbook.
4. Containment
4.1 Physical: with the person's agreement, arrange a home security review, brief household members, consider temporary relocation for Critical cases, and vary routines and travel.
4.2 Accounts: reset passwords and review recovery options on the person's work and, with consent, personal email, phone carrier, banking and social accounts; move to phishing-resistant MFA where possible; add a carrier account PIN or port-out protection. See the Securing Your Email Account Guide.
4.3 Help desk and fraud: alert the IT help desk, finance and executive assistants that the person's details are exposed. Require strong identity verification for any request made in their name, especially password resets, MFA changes and payment instructions. See the Account Recovery and Help Desk Security Guide and the Deepfake CEO Fraud Response Playbook.
4.4 Organisational information: remove or reduce personal details from corporate sites and filings where lawful, and review what assistants and staff disclose on calls.
4.5 Decision (case lead with HR and the person): whether to report to police (if not already done under 3.1), whether to inform the wider leadership team, and what work adjustments to offer.
5. Eradication
5.1 Eradication here means removing exposed content. Request removal at the source first, then from search, then from aggregators. Track every request in a removal log: URL, platform, date, route, reference and outcome.
- Platforms: use the platform's private information reporting route. For example, X prohibits sharing home addresses, non-public contact details and identity documents without permission, and accepts reports from the person or an authorised representative such as a lawyer.
- Search engines: Google's "Results about you" and removal request form cover phone numbers, home addresses, email addresses and identity numbers. Removal from search does not delete the source page, so pursue the site as well.
- Data brokers and people-search sites: submit opt-out or erasure requests. In the UK, the right to erasure applies on stated grounds; organisations have one calendar month to respond (extendable by two months for complex cases), and a refusal can be complained about to the ICO.
- Hosting providers and registrars: where a site ignores requests, counsel may write to its host.
- Jurisdiction-specific routes: some laws target doxxing directly. Hong Kong's section 64 offences under the Personal Data (Privacy) Ordinance took effect on 8 October 2021; see the Hong Kong PDPO Guide. In England and Wales the CPS lists "publishing any statement or other material relating or purporting to relate to a person" among stalking behaviours under the Protection from Harassment Act 1997, which generally requires a course of conduct.
5.2 Expect re-posting. Re-check removed locations after [7] and [30] days and log reappearances.
6. Recovery
6.1 Review the case at a cadence set by severity: daily for Critical, weekly for High, monthly for Medium until closed.
6.2 Close the case only when the safety assessment is Low, priority removals are complete or exhausted, and the person agrees.
6.3 Restore normal working arrangements gradually and only with the person's agreement: published diaries, speaking engagements and office access arrangements may need to stay restricted for several months after a High or Critical case, and family members may need their own named contact.
6.4 Offer ongoing support: counselling, family briefings, and a named contact for future concerns.
6.5 Keep monitoring for re-exposure for [6 to 12] months for High and Critical cases, using a provider or service agreed with the person.
7. Communication and notification
7.1 Keep circulation on a need-to-know basis; the person's details must not spread further through internal email.
7.2 Do not comment publicly on the content or the person's personal circumstances; prepare a holding statement for media enquiries.
7.3 If internal systems were the source, legal assesses data breach notification to the regulator and affected individuals.
7.4 Brief the board or executive committee on Critical cases, with the person's agreement on detail.
8. Post-incident review
8.1 Within [15] working days of closure, review: time to safety decision, time to first removal, removal success rate, whether help desk and fraud controls held, and how the person experienced the process.
8.2 Feed lessons into the prevention programme: footprint reduction for covered people, privacy of corporate filings, training for assistants and help desk.
8.3 Record whether the exposure led to account takeover or fraud attempts against [Organisation].
Implementation guidance
- Choose the route by situation:
Situation First route Follow-up Threat of violence or hoax emergency call at home Police, immediately Protective security, evidence to police, platform reports Repeated hostile posting by the same person Police report and legal advice on harassment or stalking routes Platform reports, removal log, protective orders where available Single neutral listing on a people-search site Opt-out or erasure request Search removal, re-check after 30 days Data in a ransomware leak or extortion message Main incident response process and counsel Account and fraud controls, notification assessment Data traced to an internal system or employee Data breach and insider investigation HR process, regulator notification assessment - Define covered people in advance and offer them a pre-incident footprint review and a single number to call.
- Pre-contract providers for protective security, removal and counselling so Critical cases are not delayed by procurement.
- Write template letters for erasure requests, platform reports and host notices, approved by counsel.
- Train the help desk and executive assistants on verification for requests made in an executive's name.
- Exercise the playbook yearly with security, HR, legal and communications together.
- Small organisations can combine the case lead and HR roles, but should still name a police contact and a counsellor in advance. Large organisations should hold covered-person data in a restricted case system, not email.
- Metrics: time from report to safety decision; time to first removal request; share of priority URLs removed within 30 days; re-exposure rate; fraud or impersonation attempts linked to the exposure; covered people with a completed footprint review.
References: NIST: SP 800-61 Rev. 3 Incident Response Recommendations and Considerations for Cybersecurity Risk Management · Google: Remove results about you from Google Search · ICO: Your right to get your data deleted · CPS: Stalking and Harassment legal guidance · X: Private information and media policy
Related NHI Mgmt Group resources: Executive Protection and Digital Footprint Guide · Doxxing Prevention Guide · Hong Kong PDPO Guide · Executive and VIP Device Protection Guide. This guide summarises legal routes for information only and is not legal advice.