Guide

Dark web monitoring

Dark web monitoring watches criminal markets and breach dumps for your email addresses, passwords and other identifiers, and tells you when they appear. Used properly it is an early warning. Sold badly it becomes a feed nobody reads.

Published 30 August 2026. Checked against the cited sources on that date.

This guide explains how monitoring works and what it can support. It is not legal advice, and it does not describe any product I sell. Where a free option does the same job, I have said so.

What it actually is

When a company loses its customer database, that data does not sit still. It is traded, combined with older losses, repackaged and republished, sometimes for money and often for status. Collections assembled this way circulate for years and are far easier to obtain than the phrase "dark web" suggests. Much of the material is not hidden at all: it sits in file sharing services, private forums and chat channels, alongside the marketplaces that give the term its atmosphere.

Monitoring services collect from those places continuously. You register identifiers you care about, usually email addresses, sometimes a domain, a phone number or a payment card range, and the service searches its collections for matches. When one appears, you get an alert naming the source breach, the date it was published, and which fields were present: an address alone, an address and a password, an address and a home address, and so on.

That is the whole mechanism, and it is worth being clear about what a match means. A hit tells you that a service you once used was breached and that your details were in the material that leaked. It does not mean anyone is looking at you. It does not mean an attack is underway. Almost always it is old news arriving late, about a company you had half forgotten registering with, and the correct response is methodical rather than alarmed.

What it can tell you, and what it cannot

Most of the disappointment with monitoring comes from expecting it to do a job it has never done. The honest boundary looks like this.

What it can tell you

  • That a password you used somewhere is in circulation, which matters far beyond the account it was taken from if you used it anywhere else.
  • Which credentials appeared, and roughly when they were published, so you can judge whether this is an old exposure or a recent one.
  • Which of your addresses is the most exposed, which is often a useful prompt to separate the address used for banking from the one used for shopping and newsletters.
  • That a family member's or a member of staff's address appears in the same collections, if you have registered the addresses that matter rather than only your own.

What it cannot do

  • Remove anything. Nothing is ever removed from the dark web: data that has been copied, traded and mirrored cannot be recalled, and any service promising deletion or takedown of breached credentials is selling something impossible.
  • Tell you who holds the data, how many people have it, or what they intend to do with it.
  • Prove that you are a target, or that you are not one. Absence of a hit means the data is not in that service's collections, which is not the same as safety.
  • Stop the next breach, which will happen at a company you have no control over and will be discovered on their timetable, not yours.

Read the two lists together and the value becomes clearer, and smaller. Monitoring is a smoke alarm. It is not a fire brigade, and it certainly does not rebuild the house.

What to do with a hit

The alert arrives naming a breach you may not recognise. Four steps, in order.

Change that password everywhere it was reused. This is the real lesson of every alert, and the one people skip. The breached account itself may be worthless. The damage comes from the same password sitting on an email account, a bank or a business system, because attackers take leaked combinations and try them at scale against services the victim never mentioned. If you cannot say with confidence where else that password was used, you have found the more serious problem.

Make reuse stop being a habit. A password manager, whether the one built into your browser or a separate application, generates a different password for every account and remembers them, which turns reuse from a matter of willpower into a matter of setup. The National Cyber Security Centre makes the same point in its guidance on managing passwords, and suggests trying one even if you never have. It is the change that does most to make future alerts uninteresting.

Turn on strong second factors. A passkey where the service offers one (the National Cyber Security Centre now puts these first), otherwise an authenticator application or a hardware security key, on email, banking and anything financial. A leaked password matters far less when it is not sufficient on its own, and the email account deserves the strongest protection you have because it can reset most of the others.

Treat old breaches calmly. If the alert concerns a 2017 loss from a service you no longer use, the exposure was already years old when you learned of it. Close the account if you can, change anything reused, and move on. Alerts of that kind are the majority, and a monitoring product that presents each one as an emergency is training you to ignore the one that matters.

The honest free baseline

Have I Been Pwned lets anyone check an email address against a large collection of known breaches at no cost, and will notify you by email if that address appears in a future one. It is the reference the industry works from, and for an individual it covers a good deal of what a paid subscription offers.

Start there. Check every address the family actually uses, including old ones still receiving post from banks or schools, and act on what comes back using the four steps above. If, after that, a paid service still looks worthwhile, you will at least be buying it knowing what the free option already told you, and you will be able to ask a supplier the useful question: what do you cover that this does not?

Where it fits for a family

Bought in isolation, monitoring tends to fail in a particular way. The alerts arrive, at first they are read, then they become routine, and within a few months nobody is opening them. The feed was never the problem. The problem is that a signal without a person attached to it is not a control.

It works better as one feed inside a wider arrangement. Under a retained private digital office, hits arrive somewhere with someone accountable for acting on them, which means the reused password gets changed rather than noted, and a pattern across several family members gets recognised as a pattern rather than four separate emails.

The other half of the job happens before any alert. A family cyber review looks at where passwords are reused, which accounts still rely on a text message as their second factor, and which addresses sit at the centre of everything, and puts the findings in writing. That work finds the reused passwords before a breach does, which is the only sequence in which finding them is comfortable.

Sources