Dark web monitoring
Also known as: dark web scan, credential monitoring, breach monitoring, identity monitoring
Dark web monitoring is a service that continuously scans hidden forums, marketplaces, and breach databases for your company's exposed credentials and data.
When your staff's emails or passwords show up in a leak, you're alerted so you can reset passwords and tighten defences before criminals exploit them.
Dark web monitoring, explained at three levels
At home
Imagine a pawn shop in a back alley where stolen goods are sold, and a friend who checks it daily for anything with your name on it. Dark web monitoring is that friend. Criminals trade leaked emails and passwords on hidden forums. A monitoring service scans those listings and breach collections, then alerts you when your details appear, so you can change the password before someone uses it.
At work
Dark web monitoring is a service that searches criminal marketplaces, forums, and leaked breach databases for credentials tied to your company's email domain. When a staff email and password appear, you get an alert with the source. For a business, it provides early warning that a working password may be circulating, often from a breach at an unrelated website where an employee reused it.
At home
The service works by collecting leaked data, not by watching you. Providers gather breach dumps from forums, paste sites, and Telegram channels, along with logs from infostealer malware that grabs saved browser passwords from infected computers. They index billions of records and match them against your email address. Free services like Have I Been Pwned do this for individuals. A match usually means a site you used was breached, not that your own computer was hacked.
At work
Business monitoring watches your whole domain, such as every address ending in @yourfirm.ca. Alerts show which employee, which breach, and what was exposed: email only, a hashed password, or a plaintext password. The biggest risk is credential stuffing, where attackers try leaked email and password pairs against Microsoft 365, VPNs, and other logins. Infostealer logs are especially dangerous because they often include session cookies that can bypass MFA.
At home
Not every alert carries the same weight. A password stored with a strong hash like bcrypt is hard to crack, while an unsalted MD5 hash or plaintext can be used immediately. Infostealer records are fresher and more dangerous than a ten-year-old breach dump. While these services can't remove anything once it leaks, in my view they're worth having for the simple prompt to change reused passwords before someone tries them.
At work
Dark web monitoring is a detective control, not a preventive one. Its value depends on the response workflow behind it: confirmed exposures trigger forced password resets, revocation of active sessions and tokens, and a review of sign-in logs for the affected accounts. Data quality varies widely between providers, with many recycling old breach compilations. It supplements MFA, a password manager, and conditional access, but it cannot replace any of them.
Real-world examples
At home
Lena's personal email showed up in a dark web alert from an old shopping-site breach. Because she'd reused that password on a few accounts, she used the alert as a prompt to change them all and switch to unique passwords in a manager.
At work
Jerome's accounting firm subscribed to dark web monitoring through their MSP. An alert flagged three staff emails with passwords from a breached third-party app. IT forced resets and confirmed via login logs that none had been used to access company systems, a threat neutralized before it landed.
Common confusions
- Dark web monitoring prevents breaches — It's a detection and early-warning tool, not prevention. It tells you what's already exposed so you can react; MFA and good passwords are what actually stop the exposure from being exploited.
- A dark web alert means our network was hacked — Usually it means an external website you or your staff used was breached. Your own systems may be untouched, but reused passwords could still put them at risk, which is why resets matter.
- Found data can be removed from the dark web — Once leaked, data can't be recalled: it spreads across countless copies. The only effective response is to change the exposed credentials and reduce their value.
For analysts
Treat every dark web alert as a prompt to reset the exposed credential and verify MFA is on. The real value isn't the alert itself: it's having a rehearsed response that turns each exposure into a quick, contained reset rather than a breach.
History & origin
As massive data breaches became routine in the 2010s, stolen credentials flooded criminal marketplaces on the dark web. Security firms began aggregating breach data and offering monitoring so organizations could learn when their information leaked. What started as an enterprise service became affordable for small businesses through MSPs, driven by the reality that reused passwords from old breaches fuel new attacks.