What Is the Dark Web?
The internet is not one uniform space - it has layers. The surface web is the part you access through Google, Bing, or any other search engine. It represents only a small fraction of all internet content. The deep web is the much larger portion of the internet that is not indexed by search engines - your email inbox, your bank's internal pages, corporate intranets, and databases all live here. The dark web is a specific portion of the deep web that is intentionally hidden and can only be accessed using specialized software, most commonly the Tor browser.
The dark web is not inherently criminal. It has legitimate uses: investigative journalists use it to communicate with sources in countries where press freedom is restricted, activists in authoritarian regimes use it to organize safely, and privacy advocates use it to avoid surveillance. However, it is also home to criminal marketplaces where stolen data is bought and sold at scale.
When a data breach occurs at any company that holds your data - a social media platform, a software tool your employees use, a healthcare provider, an e-commerce site - that stolen data often ends up for sale on dark web marketplaces within hours or days of the breach. The buyers are typically other cybercriminals who use the credentials to attack corporate systems.
How Credentials End Up Compromising Your Business
The path from a third-party data breach to a successful attack on your organization typically works as follows. A breach occurs at some service - LinkedIn, Adobe, Dropbox, Trello - any platform that your employees happen to use with their work email address. Millions of email and password combinations are extracted and sold on dark web forums.
The buyers of this data run automated "credential stuffing" attacks. They take the list of breached email/password combinations and systematically test them against corporate login portals - your VPN, your email platform (Microsoft 365 or Google Workspace), your HR system, your project management tools. If even one employee has reused the same password across their personal account on the breached service and their corporate account, the attacker gains access.
This is not theoretical. Credential stuffing is the cause of a significant portion of corporate account takeovers. Research consistently shows that 60-70% of people reuse passwords across multiple services. This means that a breach at one company creates a risk vector for your organization even though you were not the breached party.
How Dark Web Monitoring Works
Dark web monitoring services - like the capability built into FortifyNet - continuously monitor known breach databases, dark web forums, and paste sites for credentials associated with your organization's domain. When they find an email address ending in your domain in a breach database, they alert you.
FortifyNet uses the HaveIBeenPwned (HIBP) API, built by security researcher Troy Hunt. HIBP is the largest and most comprehensive publicly available database of compromised credentials, containing over 14 billion records from thousands of breaches. The database is updated whenever new breach data becomes available, which means you receive alerts not just about historical breaches but about new ones as they emerge.
An important technical note: the way FortifyNet queries this database protects your privacy. Rather than sending your email addresses or passwords to the API, it uses a technique called k-anonymity. Only the first five characters of a hashed credential are sent - enough to look up a list of potential matches, which are then compared locally. Your actual credentials are never transmitted.
Understanding What Breach Data Tells You
When FortifyNet detects that credentials from your domain are exposed, you will see specific information about each breach: which service was compromised, what types of data were exposed (email addresses, passwords, names, phone numbers, and so on), when the breach occurred, and how many records from your domain were involved.
This information is actionable. If the breach occurred in 2018 and exposed only email addresses (not passwords), the risk level is lower - but those email addresses can still be used for targeted phishing. If the breach exposed password hashes from 2022, those hashes may have already been cracked and the plaintext passwords circulated. Even old breaches matter because password reuse means a five-year-old breach can still unlock accounts today.
Incident Response When Credentials Are Found
Discovering that your organization's credentials appear in breach databases requires an immediate, structured response. The priority in the first 24 hours is to contain the exposure: identify every affected email address and account, force immediate password resets for those accounts, enable or verify that multi-factor authentication (MFA) is active on all affected accounts, and review access logs for those accounts over the past 90 days to identify any suspicious activity that may have already occurred.
Within the first week, the focus shifts to prevention and communication: notify affected employees (frame this as a security alert to help them, not as an accusation), conduct awareness training on password hygiene and the risks of password reuse, review whether those accounts had access to sensitive systems that may have been compromised, and consider whether any data that those accounts could access may now be at risk.
If your organization is subject to GDPR and the breach involves personal data of EU citizens, you may have an obligation to notify your supervisory authority within 72 hours of becoming aware of a breach. This is why having a monitoring service that alerts you promptly is valuable - it starts the clock for your notification obligation.
Preventing Future Exposures
The most effective preventive measures are also the simplest. Requiring strong, unique passwords enforced through a corporate password manager eliminates the password reuse problem at its root. When employees use different passwords everywhere, a breach at one service cannot compromise their corporate accounts.
Multi-factor authentication (MFA) is the single most effective control for preventing account takeover even when credentials are compromised. An attacker who obtains a correct password still cannot log in without the second factor. Hardware security keys (FIDO2/WebAuthn) are the strongest form of MFA because they are phishing-resistant - they cryptographically bind the authentication to the specific website being logged into, making it impossible for a phishing site to steal the factor.
Frequently Asked Questions
How many breached accounts is serious? Any number. Even one exposed account belonging to an employee with elevated privileges - an IT administrator, a financial approver, an HR manager - can be catastrophic. Treat every alert as high priority regardless of count.
We use Google Workspace and they have strong security. Are we still at risk? Yes. The risk is not Google being breached - it is your employees using the same password for their Google account that they used for some other service that was breached. Google's security is excellent, but it cannot protect against correct passwords being used.
How long does it take for breached data to appear in monitoring services? Major breaches are typically discovered and added to databases like HIBP within days to weeks of the breach becoming known. However, some breaches circulate privately on dark web forums for months before becoming public. This is why continuous monitoring matters - the data keeps expanding.
We changed all passwords after a breach alert. Are we safe? Yes, if you also enabled MFA on affected accounts. Passwords alone are not sufficient - MFA ensures that even if future credentials are compromised, attackers cannot use them.
Should we tell affected employees which specific service their credentials came from? Yes. Employees should know so they can also change their passwords on that personal service, and so they understand the specific risk. Transparency builds security culture rather than undermining it.
Originally published at fortifynet.com/blog/dark-web-monitoring-guide. I'm the founder of FortifyNet, a website security scanner; this article comes from our blog, so factor in that founder bias when you read any tool recommendations here.
Top comments (0)