Dark web

What it is

Dark web does not mean everything there is illegal, but criminal markets do use it to trade breached passwords, Social Security numbers, medical data, and full identity kits. Data may come from breaches, malware, or phishing.

For consumers, the practical concern is exposure: if your email, password, or PII appears in those markets, attackers may try credential stuffing, account takeover, or identity fraud.

How it works

1. Breach or theft — A company leak, malware, or phishing harvests your data.
2. Listing — Sellers post dumps or combo lists on forums and markets.
3. Purchase / reuse — Buyers test logins across sites or open new credit lines.
4. Impact — You see lockouts, strange charges, or new accounts you did not open.
5. Dark web monitoring watches for your identifiers in known breach corpora and underground listings — it does not delete the internet, but it can speed up your response.

Red flags

• Password-reset emails you did not request across multiple sites
• Logins that fail because someone changed your credentials
• Credit or bank alerts for accounts you never opened
• Notices that your email appeared in a known breach
• Friends getting odd messages from your social or email accounts
• Unsolicited one-time codes arriving on your phone

What to do if you’re targeted

• **Change passwords** on important accounts, starting with email; use unique passwords and a manager.
• **Turn on multifactor authentication** wherever you can.
• **Watch credit and bank activity**; consider a credit freeze if SSN exposure is likely.
• **Update anything reused** — if one password leaked, assume it was tried elsewhere.
• **Report fraud** to institutions involved and to ReportFraud.ftc.gov (U.S.) when identity theft is in play.
• **Optional:** run a free identity scan and consider monitoring that includes dark web and social signals, plus identity theft insurance up to $1M (subject to policy terms).

Related terms

• Data breach
• Identity theft
• Credential stuffing