doxing means that they are publishing all the information they are finding by public channels or by extracting without reaching the real innercore of your infrastructure
it is a kind of scanning but more concentrated on the human aspect of an attack strategy
when that starts, one knows that more is coming and one needs to make the doxed persons aware of that
and no, it will not be with known viruses but by zerodays in the mail and phonecalls to the persons impersonating others
I know it is a holiday, but isn't that the best social engineering period ?