Check If Your Data Is on the Dark Web
A five-step plan: breach-notification tools, what vendor 'dark web scans' actually see, password and credit moves, and why you should not go hunting on markets.
You cannot get a complete inventory of every onion shop. You can find out whether your mail address or phone has already appeared in the public breach corpus, and you can make those records useless for the next stuffing run. That is the honest scope. The supply chain behind the listings is how stolen data moves. This page is the consumer checklist.
Step 1: Check a breach-notification service you did not just Google
Have I Been Pwned (haveibeenpwned.com) is the reference corpus for public dumps: you enter an email, it tells you which named breaches and pastes included it. Firefox Monitor and several password managers call the same style of API. Use the official site or a vendor you already pay; do not use a lookalike "dark web scan" that wants a phone number and a credit card up front.
What a hit means: that address was in a file a researcher or a journalist ingested. What a miss means: nothing useful. Fresh stealer logs and private shops are not in the corpus yet, and some never will be.
If you get a hit, write down the breach year and the data classes (password, phone, address). You will need that in step 3.
Step 2: Understand what a paid "dark web scan" can see
Banks, antivirus suites and identity-theft products advertise dark-web monitoring. Most of them subscribe to the same commercial breach feeds and a list of forum scrapes. They are better than nothing for a second email you forgot to check. They are not a live tour of every market.
They will not reliably see:
- a log that was sold once in a private chat and never posted
- data sitting on a ransomware leak site for three days
- a clone shop that opened this morning
They will cheerfully alert you about a 2016 forum dump you already know about. Read the date before you panic. If a scan demands you "pay to remove" the listing, treat it as a scam pattern, not a service.
Step 3: Rotate the credentials that still work
Assume the password from that breach is public. Change it on the breached site and on every other site where you reused it. A password manager is how you stop the reuse; it is not optional hygiene after the second hit.
Turn on MFA. Prefer an app or a hardware key over SMS if the account offers it. Stealers can still lift a session cookie, so also use the "log out all devices" control on mail and banking. Carding terminology will not help you here; unique passwords will.
If the dump included a government ID or a tax number, you are in identity-recovery territory, not just password territory. Keep the breach notice; you will need it for disputes.
Step 4: Freeze or monitor credit where that exists
In the United States you can place a credit freeze with the major bureaus (Equifax, Experian, TransUnion) at no charge. A freeze blocks most new-account fraud; it does not block misuse of an existing card. Fraud alerts are a weaker, faster cousin.
In the UK, statutory credit freezes are not a one-to-one copy of the US model; CIFAS protective registration and the credit-reference agencies' own tools are the usual path. In the EU, it depends on the member state — start with the national data-protection authority's breach guidance, not a US blog.
This step addresses the identity-pack branch of the market, not a reused Netflix password.
Step 5: Watch for phishing that quotes the leak
The useful fraud after a named breach is mail that says "we have your password from the X hack, pay in Bitcoin or we send the photos." The password may be real and old. The rest is theatre. Do not pay. Do not click the "secure portal."
Tell family if a phone number was in the dump; SIM-swap and "your grandson is in jail" calls get easier with a real last name and a city. The risks overview is the wider map; this is the week-one behaviour.
What not to do
- Do not go looking for your own row on a market or a leak forum. You will find phishing clones, malware, and a member database that may be seized later.
- Do not pay a removal service or "reputation firm" that promises to erase the dark web.
- Do not buy your own fullz "to see what is out there." That is how people enter the same economy as the buyers.
- Do not send a copy of your passport to a random chat that claims it can help.
You cannot delete data from the dark web
Copies replicate. A takedown on one board is a re-upload on another. The workable end state is: the copy exists and it no longer opens anything you care about. That is a password-and-credit problem, not a deletion problem. If a journalist or a researcher asks you to confirm a dump, talk to them on a channel you chose; do not upload extra documents into the same mess.
For the newsroom side of handling leaks, see journalists and the dark web and SecureDrop.
Frequently Asked Questions
If Have I Been Pwned says I am clean, am I clean?
No. It means your address is not in their ingested public corpus. Stealers and private sales are outside that set.
Should I pay for identity monitoring?
It can catch some new-account fraud you would otherwise see late. It cannot pull files off onion sites. A credit freeze (where available) plus unique passwords does more than a monthly score report.
Someone emailed me my old password and a Bitcoin demand. What now?
Change the password if you have not, keep MFA on, do not pay, and report the mail as phishing. The password is usually from a public dump, not from a camera in your house.
Can I ask a forum admin to delete my record?
You would be negotiating with an anonymous operator who profits from the file. Even a yes is meaningless once the file has been downloaded. Skip it.