An Activist Investor Doxxed Our Board — How We Mapped the Threat Actor in 72 Hours

Background

Board members of a publicly traded pharmaceutical company began receiving threatening mail at their home addresses. Simultaneously, their personal information appeared on Reddit, X/Twitter, and two niche activist forums, accompanied by calls for "direct action."

Investigation Methodology

1. Post Attribution Analysis: All doxxing posts were analyzed for linguistic patterns, posting times, and account histories to identify whether they originated from a coordinated group or individual.
2. Forum Infiltration & Monitoring: The activist forums were monitored for escalation indicators and planning discussions that might suggest physical threats.
3. Cross-Platform Identity Correlation: Accounts posting the doxxing content were traced across platforms using username variations, writing style analysis, and temporal posting patterns.

Key Findings

• The campaign was coordinated by 3 individuals affiliated with a short-seller research firm that had recently published a negative report on the company.
• All doxxing posts were published within a 4-hour window, suggesting pre-planned coordination.
• The personal information was compiled from data broker sites, property records, and a LinkedIn scraping operation.
• Escalation language in private forum threads indicated potential for physical confrontation at the company's upcoming shareholder meeting.

Outcome

The intelligence was provided to the company's corporate security team and outside counsel. Cease-and-desist letters were served. Enhanced physical security was deployed at the shareholder meeting. No incidents occurred. Total investigation time: 72 hours.