Dark web monitoring: What you need to know

Dark web monitoring for business is an early warning service. It watches criminal marketplaces, forums, breach dumps and infostealer logs for your company’s email addresses and logins, and tells you when one turns up, so you can reset it before someone uses it. It works like an alarm: it tells you which door to check.

That warning matters because there is usually a gap between when a login is stolen and when it is used. Monitoring is how you use that gap, provided you know what it covers and what to do when it fires.

What the dark web is

The internet has three rough layers. The surface web is everything a search engine can find. The deep web is content behind a login, such as your bank, your email and your practice management system, and almost all of it is legitimate. The dark web is a small set of sites reached only with anonymizing software such as the Tor browser. Search engines don’t index it, and the people running and visiting sites there are hard to trace.

Journalists and people in heavily censored countries use it too. Its anonymity also makes it the main marketplace for stolen data: logins, card numbers, personal records, medical information and access to company networks, along with ransomware kits and hacking services for hire.

How your logins end up for sale

Your own systems don’t have to be breached for your company’s information to be on sale. A common path: a staff member saves their work password in a personal browser at home, malware on that family computer copies every saved login, and a few weeks later the bundle is listed on a criminal forum with your Microsoft 365 login inside.

• 01Breaches at other companies, when staff sign up for vendor portals, conference apps or shopping sites with a work email and reuse the work password.
• 02Infostealer malware, which grabs saved passwords, browser cookies and session tokens. Stolen session cookies can sometimes let an attacker skip the password and MFA prompt entirely.
• 03Phishing pages that collect credentials for direct use or resale.
• 04Breaches of your own systems or your vendors, where client or patient records are taken and sold or used for extortion.

Verizon’s 2026 Data Breach Investigations Report describes infostealers as a pipeline to ransomware. Stolen credentials are packaged and sold by initial access brokers, so ransomware gangs can simply buy their way in.

How dark web monitoring for business works

A monitoring service continually collects data from breach dumps, criminal forums and marketplaces, paste sites and infostealer logs, then checks it against what you ask it to watch, usually your company’s email domains. When it finds a match, it reports which account was exposed, roughly when, and where the data came from. We offer it to our clients, and when it finds one of their accounts, we notify the client so the follow-up can start.

Microsoft runs a similar check for its own customers. Microsoft Entra ID compares leaked credentials found on the dark web and other sources against current passwords in your tenant and flags matching users as high risk. Automatically forcing a password reset on those users takes risk-based Conditional Access, which needs a higher Entra license.

Limits to know

Monitoring can’t remove your data from the dark web, and it won’t see private groups or direct sales between criminals. It also can’t tell you whether a stolen password has already been used. Your sign-in logs answer that.

What to do when an alert comes in

1. Reset the password for the exposed account and for any other account that used the same password.
2. Sign the user out everywhere, which cuts off an attacker using a stolen session cookie.
3. Check the sign-in logs for logins from unusual locations or devices since the exposure date.
4. Look for changes an attacker might have made, such as new mailbox forwarding rules, new MFA methods or connected apps.
5. Find the source. If it was an infostealer, the infected device, possibly a home computer, needs cleaning or the next password will be stolen too.
6. Write down what you checked. If client, patient or financial data was involved, you may have notification duties.

If you see signs that someone actually got in, treat it as an incident. Our guide to data breach response covers the next steps.

Make a leaked password useless

• Turn on MFA everywhere, starting with email, remote access, banking and admin accounts. Phishing-resistant methods such as passkeys hold up best.
• Use a business password manager so every account has a unique password. We provide a managed one for our clients. Our post on how password managers work explains the setup.
• Stop forcing routine password changes. NIST’s current guidance says not to require periodic changes, but to check new passwords against lists of compromised ones and to force a change when there is evidence of compromise. A monitoring alert is that evidence.
• Keep work logins off personal devices, or manage those devices.
• Train staff on phishing and on keeping their work email out of personal sign-ups.

Leaked passwords also feed password spraying, so these steps pay off twice. For accounting, tax and financial firms, they map to Safeguards Rule requirements such as MFA. See IT for accounting and financial firms, and our cybersecurity services and managed IT services for how we handle the follow-up.

Your company’s addresses may already be in breach data, and finding out is the first step. Book a 15-minute call and we can talk through where to start.

Frequently asked questions