This article develops a framework for analysing the harms of doxxing: the practice of publishing personal identifying information about someone on the internet, usually with malicious intent. Doxxing is not just a breach of privacy, nor are its effects limited to first‑order harms to an individual’s bodily integrity. Rather, doxxing increases the spectre of second-order harms to an individual’s security interests. To better understand these harms—and the relationships between them—we draw together the theories of Bhaskar, Deleuze and Levi to develop two concepts: the virtualisation of violence and harm imbrication. The virtualisation of violence captures how, when concretised into structures, the potential for harm can be virtualised through language, writing and digitisation. We show that doxxed information virtualises violence through constituting harm-generating structures and we analyse how the virtual harm-generating potential of these structures is actualised through first- and second-order harms against a doxxing victim. The concept of harm imbrication, by contrast, helps us to analyse the often-imbricated and supervenient relationship between harms. In doing so, it helps us explain the emergent – and supervenient – relationship between doxxing’s first- and second-order harms.