Dark Web Monitoring

The dark web is a set of overlay networks - most famously Tor - that let people run websites and marketplaces without revealing where they're hosted or who runs them. That anonymity has legitimate uses (journalists, whistleblowers, privacy tools), but it also hosts a thriving underground economy in stolen data. Criminal marketplaces, invite-only forums and Telegram channels sell breach dumps, combolists and infostealer logs by the gigabyte, often for less than the price of a lunch.

Credentials get there in four main ways. A third-party service you use gets breached and the attacker dumps the user table. Infostealer malware on someone's home laptop silently harvests every saved browser password and cookie, then uploads them in batches. Phishing campaigns capture usernames and passwords straight into an attacker's dashboard. And credential stuffing - trying old passwords from one site against dozens of others - takes previously exposed passwords and turns them into fresh account takeovers.

For a UK SME, the risk isn't abstract. Once a business email and reused password are on a combolist, attackers use automation to hit Microsoft 365, banking, CRM and remote access portals within hours. That's how most business email compromise (BEC), invoice fraud and ransomware attacks actually start - not with a novel zero-day, but with an old password that never got rotated. The Information Commissioner's Office (ICO) treats reasonable password and credential controls as a baseline expectation, and every mainstream cyber insurance renewal now asks about it.

Our free checker queries a licensed breach intelligence dataset (Enzoic) covering billions of exposed records. We only ever send a SHA-256 hash of your email address - the plaintext never leaves our server, and we never see or store any password. If we find exposures, you get the breach name, date, category and what data classes were exposed. The rest is a plan: what to reset, what to enable, and how to move from reactive checks to continuous monitoring for your whole domain.

If ongoing coverage matters, we operate a paid dark web monitoring service that watches every mailbox on your domain and alerts within minutes of a new exposure appearing - including from infostealer logs, which surface long after the original breach. It plugs into our Managed SOC and Microsoft 365 hardening so alerts turn into resets, revoked sessions and MFA re-enrolment, not just noise in an inbox.