DogeQuest.
Where the data came from.
In March 2025 a site published the names, home addresses, phone numbers, employers and vehicle details of roughly 1,700 Tesla owners and people connected to DOGE, then moved to the dark web. The public question was who was behind it. The useful question was where the data came from, because that decided who else was exposed. The firm answered it: one 2021 breach of a parking app, matched at 98.2 percent, enriched with broker data.
A doxxing site, then a dark web address.
DogeQuest (dogeque.st) began on the surface web as a doxxing operation against Tesla owners and people affiliated with Elon Musk's Department of Government Efficiency. It later moved most of its personal data operation to the dark web, rebranded as DogeQuest Unleashed.
What it published
- Names
- Home addresses
- Phone numbers
- LinkedIn handles
- Employer and job title
- Vehicle registration details
What it said it was for
Pressure on anyone associated with Tesla or with Musk's government initiatives, by exposing their private information. The firm's threat model reads the intent as less about inciting violence than about instilling fear: if owning a Tesla becomes synonymous with personal risk, that hurts the company more effectively than a protest or an attack on a charging station. The collateral damage to individual owners is the likely and potentially severe consequence.
One parking app breach, matched at 98.2 percent.
The investigation identified the 2021 ParkMobile breach as the source of the Tesla owner data. ParkMobile is a parking payment app used across US cities; in March 2021 a third-party software vulnerability exposed about 21 million accounts, with emails, phone numbers, licence plates and vehicle nicknames, and hashed passwords. Sold on dark web forums at first, the data later became freely available.
The corpus
A database of 21.9 million records from the 2021 ParkMobile breach was obtained and loaded.
The tell
Every record where "Tesla" or a proxy word appeared in the vehicle nickname field was extracted: 74,349 of them. The nickname was how the operators found Tesla owners.
The match
Emails and phone numbers in the DogeQuest set were compared against those records. 1,647 matched: 98.2 percent of every Tesla owner doxed.
Every sample analysed from DogeQuest matched the ParkMobile breach on email, phone and vehicle details. The linkage is a reminder that an innocuous service provider, breached through a third-party integration, can become a targeting list four years later.
The breach had no addresses. The brokers did.
ParkMobile's data carried emails, phones, vehicle details and hashed passwords. It did not carry home addresses, job titles, employers, LinkedIn or X handles. Those came from data brokers, most likely scraped or stolen from people-search sites rather than bought fresh.
Scraped, not bought
Many DogeQuest records are less enriched than a commercial broker service would have made them. The operators understood data but not the broker ecosystem, or did not want the transaction traced.
How far it could go
The firm purchased commercial data to see how easily the profiles could be extended, and was able to expand the profiles on virtually all 1,700 people substantially: more contact information, employment detail, and more.
From a list to an attack
Breached data paired with broker data expands what an attacker holds on each person. With effort, passwords, authentication tokens or cookies follow, and the threat reaches government systems, not only the individuals.
Not a list of Tesla owners. A list of people with positions.
About 1,700 people are tagged in the set. 23 records specifically target DOGE employees, their families and their connections. The firm identified more than 150 people at very high risk: DOGE staff and families, US military and federal agency personnel, executives at major technology and financial firms, policy think tanks, health officials, federal contractors and IMF advisors.
A random sample of organisations with people in the set
Specific examples, identities withheld
Job titles that indicate government work, among many more
State and federal government
- Account manager, State of California
- Assistant state coordinator, Florida
- County and district clerk
- Division chief, capital projects
- Executive assistant administrator for enterprise support
- Director, enterprise cloud solutions
- Presidential Innovation Fellow
- Senior manager, public policy
- Vice president and general manager, public sector
Defense and national security
- Branch head
- Diplomatic correspondent
- Investigator in chief
- Telecommunication specialist
Judiciary and legal
- General counsel
- Assistant general counsel, SVP
- Partner, litigation; chair of white collar and government investigations
- Co-chair, appellate practice
- Attorney, public sector
- Board member
Think tanks, health, advisory
- Nonresident senior fellow
- Vice president, smart cities
- Pulmonary and critical care
- EVP, US life sciences
- Senior advisor
- Principal, expert witness
Low odds for any one owner. Not low for the ones with profiles.
The risk to any one individual may be low, given how many Tesla owners there are. The harm could be severe, and the risk rises with profile and net worth. Giving the site airtime plays into its narrative; leaving owners unaware of their exposure is worse.
Assets at risk
- Physical safety
- Property, the vehicle first
- Digital security, further exploitation of what is exposed
- Reputation and privacy
Threat actors
- Anti-Musk extremists
- Mischief-motivated hackers and trolls
- Political or ideological actors
- Collateral: disgruntled neighbours, criminal opportunists
Vulnerabilities
- Raw owner data exposed without masking
- Proximity: owners easily identified within close range of someone motivated or unstable
- No mitigation protocols; owners unaware and unprepared
- Amplification as the data is copied to forums
Five scenarios
Physical confrontation or violence
Actor. Local anti-Tesla activist or extremist
Action. Identifies a nearby owner from the site and confronts or assaults them.
Impact. Severe injury or death, legal consequences for the attacker, widespread fear.
Vandalism or property damage
Actor. Anti-Tesla individual or disgruntled neighbour
Action. Finds the owner's address and damages the vehicle, the home or other property.
Impact. Property damage, insurance claims, potential escalation.
Swatting or false reporting
Actor. Troll or online harasser
Action. Uses the doxxed address to file false police reports.
Impact. A police response at the door, potential harm, trauma, reputational damage.
Burglary or theft
Actor. Criminal opportunist
Action. Uses the doxxed information to target owners for car theft or burglary.
Impact. Financial loss, safety risk, ongoing fear.
Online harassment and doxxing escalation
Actor. Hackers or trolls
Action. Amplifies the exposure by linking further personal information: social media, family data.
Impact. Sustained harassment, privacy erosion, mental distress.
Likelihood and impact, a typical owner
| Threat scenario | Likelihood | Impact | Risk |
|---|---|---|---|
| Physical violence | Low | High | Moderate |
| Vandalism, property damage | Moderate | Medium | Moderate |
| Swatting, false reporting | Low | High | Moderate |
| Burglary, theft | Moderate | Medium | Moderate |
| Online harassment, doxxing | High | Low to medium | High |
Likelihood and impact, a high-profile owner
| Threat scenario | Likelihood | Impact | Risk |
|---|---|---|---|
| Physical violence | Moderate | Catastrophic | High |
| Vandalism, property damage | Moderate to high | Medium to high | High |
| Swatting, false reporting | Moderate | High | High |
| Burglary, theft | Moderate to high | High | High |
| Online harassment, doxxing | Moderate to high | Medium to high | High |
| Kidnapping or extortion | Low | Catastrophic | High |
| Stalking and surveillance | Moderate | Medium | High |
What may apply, and to whom.
The firm is not a law firm and this is not legal advice. It is the set of questions the briefing put to the lawyers.
Harassment, doxxing, cyberstalking
Publishing personal information with intent to harass or incite violence is a criminal act under 18 U.S.C. § 2261A (cyberstalking) and 18 U.S.C. § 119 (protection of individuals performing official duties). Hard to prove in general; targeting people connected to government makes § 119 possible.
If the actors are linked to extremist or domestic terror groups, 18 U.S.C. § 2339A (material support) may reach the use of breached data to intimidate people connected to government operations. A very specific and high burden of proof.
Renewed liability
ParkMobile did not itself expose addresses or job titles. The questions are about what followed the 2021 breach: whether affected people were adequately notified and the harm mitigated, whether the third-party vulnerability was adequately remediated, and whether contributory negligence applies to the downstream exploitation.
The existing settlement could conceivably be reopened or renegotiated.
What the briefing asked for.
Digital executive protection
A comprehensive threat surface assessment; proactive mitigation of identified and emerging threats; removal of exposed personal information from data brokers; continuous dark web monitoring for compromise and leaks; monitoring of social platforms, forums, extremist sites and comment sections for threats, doxxing attempts and indicators of compromise.
Obscurity DEP →Mandatory cyber security and privacy training, together
Data privacy: how to manage sensitive personal data, with practical examples of how personal data is used to compromise an organisation. Account security: unique passwords, multi-factor authentication on official and personal accounts, the risk of reuse, and recognising phishing and social engineering aimed at either. The combination works better than either alone: an employee who can see the privacy impact on themselves applies the security principles to company data.
Tactical Privacy Training →The briefing, the reporting, the video.
ObscureIQ briefing to the public, 2 April 2025
Twenty-eight pages: the analysis, the scope of exposure, the data source analysis, the threat model, the legal implications and the recommendations.
Download the PDF → PressDaily Caller, 3 April 2025
Coverage of the finding that the DogeQuest data traced to the ParkMobile breach.
Read the article ↗ VideoThe briefing, on YouTube
The DogeQuest findings presented on camera.
Watch ↗Bring us the thing that escalated.
Groundtruth answers who is behind it and where it came from, and delivers the finding in a form counsel can file on. The DogeQuest briefing is what that looks like when it is published; client matters never are.
The source was the finding.