What is the dark web, and why should your business care?

What it actually is

A small set of networks, mostly Tor, that require specific software to reach and that hide the location of the servers. Alongside legitimate privacy uses sit criminal marketplaces selling credential dumps, remote access to compromised networks, and ransomware tooling sold as a service.

How your data gets there

Almost never through a breach of your own systems. It arrives because a member of staff used a work email address on a third-party service that was later breached, and reused the same or a similar password. Combolists of billions of records circulate freely and are the raw material for credential stuffing.

Why exposure matters even years later

• Old passwords are reused far more often than people admit
• Email addresses feed targeted phishing that names real colleagues and suppliers
• Exposed personal data supports convincing social engineering of your help desk
• Attackers automate login attempts at scale, so exposure and attack are minutes apart

Finding out where you stand

Domain-level exposure monitoring checks your email domains against known breach corpora and tells you which accounts appear, in which breach, and whether a password hash was included. Run it once for a baseline, then continuously so new exposures surface within days.

What to do with a hit

• Force a password reset on the affected account and any account sharing that password
• Confirm MFA is enrolled and no bypass method is registered
• Check for mailbox rules, forwarding and unfamiliar sign-in locations
• Move the user to a password manager so the next reuse does not happen
• Record the exposure and the action taken for your incident log

Prevention that actually works

Unique passwords from a manager, MFA everywhere including remote access, blocked legacy authentication, and continuous monitoring so exposure is news rather than a post-incident discovery.