In case your information is on the darkish internet, it’s most likely solely a matter of time earlier than it’s abused for fraud or account hijacking. Right here’s what to do.
13 Jan 2026
•
,
5 min. learn
Opposite to standard perception, a lot of the darkish internet isn’t the den of digital iniquity that some commentators declare. In truth, there are many reputable websites and boards there providing privacy-enhanced content material and companies to assist people keep away from censorship and oppression. Nevertheless, the reality is, it’s additionally a magnet for cybercriminals, who can go to its boards, marketplaces and different websites with out concern of being tracked and unmasked.
Many of those exist to facilitate the commerce in stolen private and monetary info. Typically, private information is purchased and bought alongside different objects like narcotics, hacking instruments and exploits. So what must you do in the event you discover out your information is up on the market on one in all these websites?
How did my information get there?
There are numerous methods personally identifiable info (PII), credentials and monetary information can find yourself within the fingers of cybercriminals:
- Information breaches contain the large-scale theft of buyer/worker info, which then often seems on the market on the darkish internet. The US was on observe for a file yr on this space, having already recorded 1,732 incidents within the first half of 2025, resulting in over 165.7 million breach notifications. All of us do enterprise with so many organizations on-line as of late, the chance of being caught up in a breach is rising on a regular basis. Most of us could have skilled no less than one notification electronic mail in our lives. That danger additionally will increase because of the proliferation of double extortion ransomware assaults, the place information is stolen as a way to extort a sufferer group.
- Infostealer malware does what the identify suggests. It has grow to be extremely standard because of “as-a-service” kits like RedLine and Lumma Stealer. The malware will be hidden in legitimate-looking cell apps, on internet pages, in malicious adverts, and phishing hyperlinks/attachments, amongst different locations. The info it collects is then assembled by risk actors and bought on the darkish internet. Typically, each credentials and session cookies are stolen, making it simpler for hackers to bypass even multi-factor authentication (MFA).
- Phishing has at all times been a well-liked solution to steal info from a sufferer. However the introduction of generative AI (GenAI) instruments has made it simpler for risk actors to scale assaults, whereas additionally personalizing them, and writing in flawless native language to extend their possibilities of success. For those who unwittingly click on by way of and enter your info on a phishing web site, it may find yourself being bought on the darkish internet.
- Unintentional leaks are a standard incidence on the web due usually to misconfiguration of cloud methods, similar to failing to require a password to entry on-line databases. This may go away information uncovered to anybody who is aware of the place to look (or has been scanning for misconfigured situations). If it’s left open for lengthy sufficient, a database could possibly be stolen and bought on the darkish internet. Risk actors may additionally delete the unique database as a way to extort their company sufferer.
- Provide chain assaults are just like common information breaches, however as a substitute of the corporate you shared your information with being hacked, it’s a provider or companion group. These firms have been granted permission to entry and use that info, however usually don’t have the identical strong safety posture. They’re a lovely goal for risk actors as only one assault may assist them to entry information on a number of, company purchasers. Typically, these suppliers are digital suppliers, like Progress Software program. When a zero-day vulnerability in its standard MOVEit file switch software program was exploited in 2023, 1000’s of organizations and over 90 million downstream clients have been compromised. Information brokers are one other potential weak hyperlink. They harvest info legally through internet scraping and monitoring, however could not hold it properly protected.
What do they need?
The stuff that cybercriminals actually need is your monetary info (checking account numbers, card particulars and logins), PII, and account logins. With this, they will hijack accounts to empty them of information and funds, and presumably entry saved card info, or else use your PII in follow-on phishing makes an attempt designed to pay money for monetary info. Alternatively, they might use that PII in identification fraud, similar to making use of for brand spanking new strains of credit score, medical remedy or welfare advantages.
Biometric information is especially delicate as it may possibly’t be “reissued” or reset like a password. And session tokens/cookies are additionally helpful for risk actors as these might help them to bypass MFA.
This might have a major monetary affect. A current ITRC report claims that 20% of US fraud victims over a single yr reported losses of over $100,000 and over 10% misplaced no less than $1m.
What to do in the event you discover your info on the darkish internet
For those who’re alerted to the looks of some private and/or monetary info on the darkish internet, take the next motion (relying on the data in danger):
- Change any compromised passwords, and make sure you solely use robust, distinctive credentials saved in a password supervisor.
- Change on MFA for all accounts, and use both an authenticator app or a {hardware} safety key, moderately than SMS (which will be intercepted).
- Signal out of all gadgets, to cease hackers who could have stolen your session cookies.
- Contact your financial institution, freeze your playing cards and have them reissued.
- Freeze your credit score with every of the principle bureaus. It will stop any fraudster from opening a brand new line of credit score in your identify.
- Scan your PC/gadgets for infostealer malware.
- Report the leak to the FTC (US), Report Fraud (UK) or related European authorities.
Lengthy-term steps to maintain your PII secure
As soon as the mud has settled, there are issues you are able to do to mitigate the chance of delicate info ending up on the darkish internet. Think about companies like Cover My Electronic mail to cut back the quantity private info firms retailer. It’s additionally a good suggestion to checkout as a visitor and by no means save any card information once you store with a third-party web site.
Subsequent, cut back the possibilities of infostealer an infection and phishing by putting in respected safety software program on your whole gadgets and PCs. Solely obtain apps from official shops. And be cautious of any unsolicited emails/texts/social media messages containing hyperlinks or attachments.
Cut back the amount of information accessible to brokers by guaranteeing your whole social accounts are set to “non-public.” Use encrypted comms companies and privacy-enhanced browsers and search engines like google and yahoo. Additionally, take into account sending “proper to be forgotten” requests to information brokers, presumably through companies with the requisite experience.
Lastly, signal as much as identification safety companies and websites like HaveIBeenPwned, which can warn you when any PII seems on the darkish internet. The breach of non-public info and logins will be emotionally upsetting, in addition to financially damaging. And in the event you reuse logins throughout work accounts, it may actually have a destructive affect in your profession, if it allows hackers to entry company sources. On the finish of the day, all of us must be proactive as a way to make our digital lives safer.
