Security Guide
Is Your Information on the Dark Web?
Every major data breach ends with stolen records for sale somewhere on the dark web. With 14 billion+ compromised records from the past decade, there's a decent chance some version of your data is already out there. Here's what that actually means.
What Is the Dark Web?
The dark web is the part of the internet that standard search engines don't index. You need software like the Tor browser to access it. It's not inherently criminal — journalists, activists, and privacy researchers use it — but it's also where stolen data gets bought and sold.
Surface Web
Google, social media, news—the 4% of the internet most people use
Deep Web
Your email inbox, banking portal, private databases—not indexed by Google
Dark Web
Encrypted, anonymous networks—hidden marketplaces, forums, illicit trade
When a company's database gets breached, the records don't just sit there. Buyers on dark web markets purchase them in bulk and use them for fraud, account takeovers, and phishing. Data brokers and dark web markets are related problems: one sells your data legally, the other doesn't.
How Does Personal Data End Up There?
Corporate Data Breaches
When a company's database is hacked, millions of customer records are exfiltrated and sold. The 2024 National Public Data breach exposed 2.9 billion records. The Change Healthcare breach exposed 100+ million Americans' medical data. These records flow directly to dark web markets.
Credential Stuffing Attacks
Once breached credentials are on the dark web, attackers run them against hundreds of other sites. If you reuse passwords, a single breach at one company can compromise dozens of accounts.
Phishing Campaigns
Successful phishing attacks harvest login credentials in real time. The credentials are either used directly or sold in bulk packages on dark web markets.
Skimming and POS Attacks
Payment card data captured at compromised point-of-sale terminals or via skimming devices ends up in "card shop" markets on the dark web within hours of the theft.
Insider Theft
Malicious employees at data-rich companies (healthcare, finance, insurance) sometimes sell customer records directly to dark web buyers.
What Gets Sold and for How Much?
| Data Type | Market Price | How It's Used |
|---|---|---|
| Email + password | $2–5 | Account takeover, credential stuffing |
| Credit card (with CVV) | $5–20 | Fraudulent purchases, resale |
| Full identity package (SSN, DOB, address) | $15–40 | Identity theft, new account fraud |
| Bank account credentials | $40–200 | Direct account draining |
| Healthcare records | $1–50 | Insurance fraud, medical identity theft |
| Passport/ID scans | $10–35 | Identity fraud, account verification bypass |
| Social media accounts | $5–25 | Spam, scam campaigns, identity impersonation |
Prices fluctuate based on recency, balance, and batch size.
How to Check If Your Data Is on the Dark Web
Free breach check tools
- •Use GhostVault's free scan to check your email against 14 billion+ known breached records
- •HaveIBeenPwned.com (Troy Hunt's independent tool) checks email addresses against known breaches
- •Firefox Monitor offers free email monitoring
These tools check against known, disclosed breaches—some breached data circulates for months before becoming publicly known.
Check your accounts directly
- •Google your email address in quotes—look for any unusual mentions
- •Check if any of your accounts have "suspicious activity" notifications you may have missed
- •Review login history on major accounts (Google, Apple, Microsoft, banking)
Watch for warning signs
- •Receiving password reset emails you didn't request
- •Being logged out of accounts unexpectedly
- •Friends reporting spam or unusual messages from your accounts
- •Unexpected charges on credit/debit cards
- •New credit inquiries on your credit report
If you see these signs, assume compromise and act immediately.
What to Do If Your Data Is on the Dark Web
You can't get your data removed from dark web markets directly — they're outside any legal reach. But you can reduce what's available and limit what can be done with it:
Use unique, 16+ character passwords generated by a password manager. Enable 2FA on all affected accounts.
Even if your password is compromised, 2FA prevents account takeover in most cases.
If financial data was involved, contact your bank to monitor for fraud or issue new cards.
If SSN data was exposed, freeze credit at all three bureaus (Equifax, Experian, TransUnion) to prevent new account fraud.
Data brokers supply the contextual information criminals use to supplement stolen credentials. Removing yourself limits what they can do with your data.
IdentityTheft.gov provides a personalized recovery plan and documents the theft for insurance and credit bureau disputes.