Anti-Doxxing Personal Security: Removing Data from Brazilian Data Brokers

You type your name into Google and find a partial CPF, an old address, your mother's phone number and your sister's wedding photo indexed on a genealogy site. That is not paranoia, it is the default state of any Brazilian over 25 with an online history. The Basilisk team treats doxxing as a supply chain: every broker, every 2021 Serasa leak, every 2009 Facebook profile is a node in a graph, and the adversary only needs to correlate a few of them to reach your front door. Cutting all of them is impossible; cutting the right dozen nodes removes most of the real risk. This guide is the same runbook we run for clients targeted by stalkers, disgruntled ex-employees and extremist groups, rewritten so you can execute it yourself in one focused afternoon.

Doxxing is a supply chain, not a single leak#

Think in graphs, not incidents. Your full name links to a CPF; the CPF links to addresses and a corporate registration; the phone links to a WhatsApp photo and a delivery app; an old email links to a breach dump that reveals a reused password. An attacker pivots node to node until enough independent sources agree on where you live and who you love. This is why chasing single removals feels endless and accomplishes little: you are treating leaves while the branches regrow. The correct target is the small set of high-connectivity nodes that most other data hangs off, typically your primary phone, your home address in public registries, and one or two aggregator profiles that republish everything. Map the graph before you touch anything, or you will burn a weekend on low-value trivia.

OSINT against yourself: build the inventory first#

Before any removal, investigate yourself. Spin up a throwaway VM and a clean browser with no logins, then run structured queries: full name in quotes, name plus city, name plus partial CPF, phone with and without country code, primary email and every alias. Catalog everything in a spreadsheet with columns for URL, broker, exposed data, priority and status. Tools like Maltego CE, Spiderfoot and holehe automate part of the collection and reveal which sites your email is registered on; the step-by-step lives in Ethical OSINT: Investigating Your Own Digital Footprint with Maltego and Spiderfoot. Without an inventory you treat symptoms and leave the root intact. Expect 40 to 200 unique hits on a first pass, which is completely normal and not a sign you are unusually exposed.

Brazilian brokers and the LGPD opt-out#

In Brazil the brokers that dominate first-page results are Tudo Sobre Todos, Telelistas, ConsultasBrasil, Quem Sou Eu, Encontre uma Pessoa and Cadastros BR, plus aggregators like 4devs and various Consulta CPF clones. Each has a different opt-out flow: some accept a web form with an ID photo, some require the email registered to the number, and several ignore anything that does not explicitly cite LGPD Article 18, the data-subject rights clause. A standard request has subject line 'Erasure request - LGPD Art. 18, para V', a body quoting the specific URL, a 15-day deadline, and a stated intent to complain to the ANPD (the national data authority) if ignored. Keep everything in writing and never call, because a phone call leaves no evidence and no legal clock. In roughly 60% of cases removal lands within 7 to 20 days.

Social media: the most underestimated vector#

Your own accounts leak more than any broker. A 2010 Facebook still shows your phone under 'About'; LinkedIn exposes your exact city through the location field; Instagram embeds geotags in old stories; Strava publishes your daily run starting from your front door. Audit per platform with a checklist: profile privacy, friend and follower visibility, bulk-hide old posts, connected third-party apps, and active sessions. For any old photo you plan to keep public, strip metadata first with exiftool and mat2; the procedure is in Metadata Hygiene: Stripping EXIF, PDF and Office Before You Publish. Splitting your public persona from your private life into separate, non-linked accounts is the durable fix, detailed in Digital Compartmentalization: Separate Identities Without Leaking Metadata.

Government and judicial data: the special case#

Public records are the hardest layer because they are meant to be public. Official gazettes, TJSP case files, JusBrasil and Escavador reindex rulings alongside your CPF and address. JusBrasil accepts deindexation requests via a form citing LGPD; Escavador typically demands a power of attorney or a formal document. For sealed proceedings that were improperly exposed, the path is a direct petition to the court, not a broker form. Protest registries and the Junta Comercial leak your home address the moment you register as an MEI or company partner, so change the registered address to a coworking space or a PO box before opening the company, not after. If you are a high-visibility target such as a journalist, activist or executive, the threat model shifts entirely and Personal Security for High-Visibility Targets: Journalists, Activists, and Executives covers the additional controls.

Phone and email deserve surgical treatment#

Your phone number is the highest-connectivity node in the graph, so quarantine it. Provision a VoIP or secondary number for public registrations, marketplaces and paperwork, and keep your real number for banking, critical MFA and close family only. For email, use per-service aliases from SimpleLogin or addy.io: one alias per site, disposable the instant it appears in a breach. Migrate any SMS-based MFA to passkeys or a hardware TOTP token, because SIM-swap is a routine doxxing escalation; the migration without locking yourself out is in Passwords and MFA: Moving to Passkeys Without Breaking Your Recovery. For contact with sources or lawyers, Signal on a dedicated number is the minimum and SimpleX with no identifier at all is the ideal; the trade-offs are in Comms OPSEC: Signal, SimpleX and Session Technically Compared.

Concrete templates and commands#

Standardize so you can send twenty requests in an hour. Keep a plain-text LGPD template with placeholders for URL and exposed field, and a tracking sheet keyed by broker. To find every reappearance, use site-scoped queries such as site:tudosobretodos.com.br "YOUR NAME" and "your.email@example.com" -site:linkedin.com. To scrub a document before uploading it as proof, run exiftool -all= file.pdf and verify with exiftool file.pdf that no author, GPS or software fields remain; for images mat2 photo.jpg produces a clean copy. Store screenshots as evidence with a timestamp, because a broker that removes data and silently republishes it three months later is common, and your dated record is what turns a repeat offense into an ANPD complaint that actually moves.

Automate maintenance and monitoring#

Removal is not a one-time project, it is a subscription you never wanted. Brokers republish as they buy fresh dumps every three to six months, so build a monthly routine: a scheduled job or cron that reruns your site-scoped Google queries and emails you when a name, phone or address reappears, plus alerts from a breach-notification service on each of your aliases. Keep a versioned dossier in a private Git repository containing screenshots, sent emails, deadlines and ANPD protocol numbers, so the whole history is reproducible and defensible. This turns an anxious, ad-hoc scramble into a boring fifteen-minute review you run on the first of every month, which is exactly what sustainable OPSEC looks like.

Under active doxxing#

If you are being actively targeted right now, the order changes. First, freeze your credit at Serasa and Boa Vista to blunt identity fraud. Second, file an electronic police report to create an official record and a case number. Third, send emergency takedown requests to the platforms hosting the content, citing imminent risk to physical safety, which most legal teams escalate faster than a routine privacy request. Fourth, engage a lawyer for anything involving threats, sealed records or a court petition. Fifth, tighten your MFA and rotate the passwords on any account that shares a phone or email with the exposed data, following your personal threat model as defined in OPSEC for Security Researchers: Building a Personal Threat Model, because protocol without a model is theater.

Removal checklist#

Work the list in order: (1) inventory built via OSINT against yourself, prioritized by node connectivity; (2) top brokers sent an LGPD Art. 18 request with a 15-day deadline; (3) social accounts audited for phone, location, geotags and connected apps; (4) home address removed or replaced in public and corporate registries; (5) primary phone quarantined behind a VoIP number; (6) email migrated to per-service aliases; (7) SMS MFA replaced with passkeys or hardware TOTP; (8) documents scrubbed of metadata before any upload; (9) monthly monitoring automated with alerts; (10) a versioned dossier kept for evidence. Anything unchecked is an open node an attacker can still pivot through.

FAQ#

Can I ever be fully removed? No, and chasing that goal will exhaust you. The realistic goal is to cut the high-connectivity nodes so no single search assembles a complete picture of where you live and who you are close to. Public records and republishing brokers guarantee some residual exposure; your job is to keep it fragmented and out of date. Measure success by whether a motivated stranger can reach your door in an afternoon, not by whether every trace is gone.

Does paying a data-removal service work? Sometimes, for the volume of routine brokers, but treat it as outsourcing the boring part, not a strategy. The high-value nodes, government registries, your own social accounts, your phone hygiene, are exactly the ones these services cannot touch, and you retain the legal standing under LGPD that they merely borrow. Verify their work against your own inventory rather than trusting a dashboard, and never hand them credentials to your accounts.

Conclusion#

Privacy is not a state you reach, it is a process you maintain. Block a focused afternoon this week, run OSINT against yourself, map the graph, and fire the first dozen priority opt-outs at the high-connectivity nodes. Quarantine your phone, alias your email, freeze your address in the registries, and automate a fifteen-minute monthly review so exposure that regrows gets caught early instead of during a crisis. The attacker's advantage is that your data is scattered and correlatable; your advantage is that you decide which nodes stay connected. Cut the right ones and the doxxing supply chain runs dry, not because every record vanished, but because none of them add up anymore.