An alert saying "your data was found on the dark web" tells you that something about you was copied in a breach and is circulating among criminals, but it rarely tells you what to do next. Some of these alerts point to a real and urgent risk, such as a password you still use or a bank card that is still active. Many point to old, low-value data such as an email address that has been in dozens of breaches already. This guide explains, in plain English, what dark web exposure means for an individual, how your data ends up there, which leaks deserve action today and which do not, and the exact steps to take for each type of data. It is written for members of the public in the UK and the US, and for the IT staff they ask for help. Organisations should read the Dark Web Monitoring Guide instead.
Key takeaways
- The type of data decides the urgency. A reused password or an active card number needs action today; an old email address on its own mostly means more scam messages.
- You cannot delete data from the dark web. Nobody, including paid services, can remove a copy once criminals have it, so the fix is to make the leaked data useless.
- Passwords are the most fixable leak. Change the password everywhere you used it, then switch to unique passwords from a password manager, or a passkey where offered.
- Identity numbers need a freeze, not a change. You cannot easily change a Social Security number or date of birth, so lock your credit file and add an IRS Identity Protection PIN in the US, or use Protective Registration in the UK.
- The breach itself is often followed by scams. The most likely harm from a leak is a convincing phishing message, call or extortion email that uses your leaked details to sound genuine.
What it is
The dark web is the part of the internet that is only reachable with special software, most commonly the Tor browser, and that is not indexed by normal search engines. It hosts legitimate privacy services as well as criminal markets and forums where stolen data is bought, sold and swapped. In everyday use, "dark web exposure" has a broader meaning: any situation where your personal data has been copied out of an organisation or off your own device and is now held by people who should not have it.
You usually learn about exposure in one of four ways:
- Breach notification: the company that lost your data writes to you. This is the most reliable source, because it says what was taken.
- Free breach checkers: services such as Have I Been Pwned let you search an email address against known breaches and sign up to be told about future ones. Have I Been Pwned only sends notifications to the address being monitored, so you cannot use it to watch someone else.
- Monitoring alerts: features bundled with antivirus, password managers, banks or identity protection subscriptions scan breach data for your email, phone number or ID numbers.
- Scam messages: an email or text that quotes an old password or your address, often with a threat. This is a sign your data has leaked, not a sign that the sender has hacked you.
How it works
Personal data reaches criminal hands through a small number of routes. Knowing which one applies tells you what is at risk.
| Route | What happens | What is typically exposed | What it means for you |
|---|---|---|---|
| Company data breach | An attacker gets into a company's systems and copies its customer database | Email, name, phone, address, date of birth, sometimes hashed passwords, card details or ID numbers | The same data is exposed for every customer; check the notice to see exactly what was taken |
| Infostealer malware | Malicious software on your own device copies saved passwords, browser cookies and autofill data, then uploads them as a "stealer log" | Passwords for many sites at once, logged-in sessions, saved cards | More serious than a single breach: the device itself was compromised, and attackers may be able to use live sessions |
| Phishing | You type details into a fake site or reply to a fake message | Whatever you entered, often a password, card or one-time code | Treat that account and card as compromised straight away |
| Combination lists | Older breaches are merged and resold as huge lists of email and password pairs | Old passwords, often years out of date | Only a risk if you still use one of those passwords anywhere |
Have I Been Pwned keeps breaches, paste dumps, stealer logs and spam lists as separate categories, which is a useful hint: a stealer log match is more serious than a spam list match.
Criminals use the data in predictable ways. Leaked email and password pairs are tried automatically against many other websites, a technique called credential stuffing, which only works if you reused the password. Identity data such as a name, date of birth, address and national ID number is used to open credit in your name or to pass security questions with your bank or phone company. And almost any leaked detail is used to make a phishing message more believable. See the Account Takeover Prevention Guide for how account attacks work at scale.
Why it matters
Most of the harm comes after the breach, when the data is used. The good news is that for most types of data there is a specific action that makes the leaked copy far less useful. This table is the heart of the guide: find the data type in your alert or breach notice and follow the row.
| Data leaked | Urgency | What to do |
|---|---|---|
| Password you still use (anywhere) | Today | Change it on that site and on every other site where you used the same or a similar password. Turn on two-step verification (2SV). Sign out of other devices from the account settings. |
| Password you no longer use | Low | Check you really do not use it anywhere else. Never reuse it. |
| Email account password or session | Today, first | Secure the email account before anything else, because it can reset all your other passwords. Check for forwarding rules and filters an attacker may have added. |
| Credit or debit card | Today | Call the card issuer using the number on the back of the card, cancel the card and ask for a new one. |
| Bank account details | Today | Contact your bank through its official app or number; ask whether to close the account and open a new one. Watch for direct debits you did not set up. |
| US Social Security number | This week | Freeze your credit with Equifax, Experian and TransUnion. Get free credit reports at annualcreditreport.com. Get an IRS Identity Protection PIN and file taxes early. |
| UK identity details (name, date of birth, address, passport or driving licence number) | This week | Check your credit report with the credit reference agencies, consider Cifas Protective Registration, and be alert to calls or letters about credit you did not apply for. |
| Phone number | Medium | Expect scam texts and calls. Ask your mobile provider about a PIN or extra security on your account to make SIM swap fraud harder. |
| Email address only | Low | Expect more phishing. Be suspicious of messages that mention the breach, compensation or a password reset you did not request. |
| Saved passwords from your browser (stealer log) | Today | Clean or reset the infected device first, from a known-clean device change every saved password, sign out all sessions, and replace saved cards. |
The US steps in more detail
- Credit freeze: a freeze makes it harder for someone to open a new account in your name. It is free to place and lift, but you have to contact each of the three bureaus separately. A freeze requested online or by phone takes effect within one business day, and a request to lift it online or by phone must be processed within one hour. See the Credit Freezes and Fraud Alerts Guide.
- Fraud alert: the FTC's data breach guidance suggests that if you decide not to freeze your credit, you at least consider a fraud alert, which asks lenders to verify your identity before opening credit.
- IRS Identity Protection PIN: a six-digit number, known only to you and the IRS, that stops someone else filing a tax return with your Social Security number or ITIN. Anyone with an SSN or ITIN who can verify their identity can get one, fastest through the IRS online account or app. A new PIN is issued every calendar year, and if you enrolled online you must retrieve the new one yourself each year.
- Personalised plan: IdentityTheft.gov has a data breach section that gives steps tailored to the type of information exposed, and is where you report identity theft to the FTC if someone has already used your details.
The UK steps in more detail
- Confirm the breach safely: the NCSC advises checking with the organisation through its official website or social media, not by using links or contact details in a message you were sent.
- Check your accounts: look for signs such as being unable to log in, changed security settings or logins from unusual locations, and follow the NCSC's hacked account recovery steps if you see any. See the Hacked Social Media or Email Account Recovery Guide.
- Report scams and losses: forward suspicious emails to the NCSC Suspicious Email Reporting Service and scam texts to 7726. If you have lost money, tell your bank and report it to Report Fraud, or to Police Scotland on 101 in Scotland. See the Consumer Reporting Routes Map.
- Stronger passwords: the NCSC recommends a separate strong password for each account, such as three random words, a password manager to remember them, and a passkey where one is available.
Common misconceptions
Dark web alerts are often written to alarm rather than inform. These are the misunderstandings that cause people either to panic or to do nothing.
| Misconception | Reality |
|---|---|
| "My data can be removed from the dark web." | Copies of stolen data are traded and re-shared; no service can recall them. What you can control is whether the data still works: change passwords, replace cards, freeze credit. |
| "An email quoting my password means I have been hacked." | Extortion emails often quote a password from an old breach to look credible. The FBI has warned about emails threatening to expose data from high-profile breaches unless a ransom is paid; its advice is not to engage and not to pay, and to report it. |
| "No results on a breach checker means I am safe." | Have I Been Pwned itself says a clean search does not prove an account is safe, because many breaches are never made public. |
| "I need a paid monitoring service to be protected." | Monitoring tells you about exposure; it does not prevent fraud. Free breach checkers, free credit reports and a free credit freeze cover most of what a paid service alerts on. |
| "Changing the password on the breached site is enough." | Attackers try leaked passwords on other sites. Every account that shares that password, or a close variant, needs changing. |
Telling a real alert from a scary one
- It names the data: a useful alert says what was found (a password, a card ending in 1234, an SSN) and from which breach or source. "Your data was found on the dark web" with no detail is not actionable.
- It names the date: a breach from many years ago with a password you changed long since is history, not an emergency.
- It does not demand payment or a click: genuine notifications explain what to do and point to the company's own site; scams push you to pay, call a number or log in through a link.
How to know you have done enough
For an individual, "measurement" is a short set of checks you can repeat every few months:
- Reused passwords: zero. Your password manager's security report or audit view shows reused and breached passwords.
- 2SV coverage: on for email, banking, mobile provider, main shopping and social accounts.
- Credit file: frozen (US) or checked within the last year, with no accounts you do not recognise.
- Unknown transactions: none in the last two statements for each card and bank account.
Related concepts
- Identity theft and identity fraud: what happens when leaked identity data is actually used to borrow money or take over accounts. If that has already happened, move to the Identity Theft Recovery Guide.
- Credential stuffing: automated reuse of leaked email and password pairs on other sites; the reason unique passwords are the most important single defence.
- Pwned Passwords: Have I Been Pwned's separate service for checking whether a specific password has appeared in a breach. Its FAQ says any password found there should no longer be used.
- Password managers and passkeys: the long-term fix for password leaks. A password manager generates and remembers a unique password per site; a passkey removes the shared secret altogether. See the Password Managers Explained for Everyone Guide and the Passkeys for Everyone Guide.
- SIM swap fraud: a leaked phone number and identity details can be used to move your number to a criminal's SIM and intercept codes. See the SIM Swap Fraud Guide.
Practitioner checklist
Work through this in order after any alert.
- Confirm the alert through the company's own website or app, never through a link in the message.
- Identify exactly what data was exposed and when, using the breach notice or Have I Been Pwned.
- Secure your email account first: new unique password, 2SV on, other sessions signed out, forwarding rules checked.
- Change every password that matches or resembles the leaked one, starting with banking, shopping and social accounts.
- Cancel and replace any exposed card, and call your bank about exposed account details.
- For a US Social Security number: freeze credit at all three bureaus, get an IRS IP PIN and review your free credit reports.
- For UK identity details: check your credit report and consider Cifas Protective Registration.
- If a stealer log mentions your device, clean or reset that device before changing passwords from a clean one.
- Treat any message that mentions the breach as a likely scam; do not pay extortion emails, and report them.
- Move to a password manager and passkeys, and repeat the checks above every few months.
Standards and references
- Have I Been Pwned: Frequently Asked Questions
- US Federal Trade Commission: Data Breaches, What to Know, What to Do
- US Federal Trade Commission: IdentityTheft.gov Data Breach Information
- USAGov: How to Place or Lift a Credit Freeze
- Internal Revenue Service: Get an Identity Protection PIN
- UK National Cyber Security Centre: Data Breaches, Guidance for Individuals and Families
- UK National Cyber Security Centre: Recovering a Hacked Account
- FBI Internet Crime Complaint Center: Extortion E-mail Schemes Tied to Recent High-Profile Data Breaches
Related NHI Mgmt Group resources: Dark Web Monitoring Guide · Identity Theft Recovery Guide · Credit Freezes and Fraud Alerts Guide · Password Managers Explained for Everyone Guide