There's a good chance that at least one email address and password from your business is already sitting in a criminal database somewhere. That isn't because your business did anything wrong. It's usually because a member of staff signed up to another website with their work email, and that website was breached.
This article explains what the dark web actually is, how company details end up there, what dark web monitoring does, and what to do if your details are found.
What is the dark web?
The dark web is a part of the internet that isn't indexed by normal search engines and needs special software to access. Not everything on it is criminal, but it's where stolen data is bought, sold and swapped.
What's traded there is surprisingly ordinary:
- Email addresses and passwords from breached websites, often in lists of millions
- Logged-in sessions stolen from infected computers, which can let a criminal skip the password and multi-factor sign-in entirely
- Customer and employee records taken from businesses that were hacked
- Access to company networks, sold by one criminal to another who then runs the attack
Most of it isn't hand-picked. Criminals buy data in bulk and use automated tools to try it everywhere.
How business data ends up there
Password reuse
This is the most common route by far. A staff member uses their work email to sign up to an online shop, a training website or a conference app. That site is breached years later. If they used the same password for their work account, a criminal now has the keys to your Microsoft 365.
Phishing
A convincing email leads someone to a fake sign-in page that looks exactly like Microsoft's. They type in their password, and it goes straight to the attacker, who may use it themselves or sell it.
Infected computers
Some malware is designed to quietly collect every saved password and browser session on a computer and send them off. It often arrives through a fake software download or a malicious email attachment.
Breaches at suppliers
Your data can leak through someone else's breach: an accountant, a software provider, a recruitment agency or anyone else who holds information about your business or your staff.
Why it matters for a small business
It's tempting to think a leaked password from an old shopping account doesn't matter. It often does:
- Account takeover. Criminals use automated tools to try leaked email and password pairs against Microsoft 365 and other business systems. If one works, they're in.
- Invoice fraud. Once inside a mailbox, attackers watch real conversations, wait for an invoice to be sent and then email your client with "updated bank details". The email comes from your genuine address, so it looks completely legitimate.
- Targeted phishing. Leaked details tell criminals who works for you, what systems you use and who to impersonate.
- Data protection obligations. If personal data is involved, you may have obligations under GDPR, including deciding whether to notify the Data Protection Commission, which must normally be done within 72 hours of becoming aware of a reportable breach.
What dark web monitoring does
Dark web monitoring watches breach databases, criminal marketplaces and forums for anything linked to your company's email domain. When it finds a match, you get an alert telling you which email address appeared, when and, where possible, in which breach.
That gives you the chance to change the password and lock down the account before a criminal uses it.
It's worth being clear about the limits too:
- It can't remove data from the dark web. Once something has leaked, it's out there. Monitoring tells you so you can make the leaked details useless.
- It doesn't cover everything. No service sees every criminal marketplace. It's an early warning system, not a guarantee.
- It works best alongside other protection. Multi-factor sign-in, unique passwords and account monitoring are what actually stop a leaked password being used.
What to do if your company's details are found
If an alert comes in, or you discover a leaked password some other way, work through these steps:
- Change the password straight away, on the work account and on any other account where the same password was used.
- Sign the user out everywhere. In Microsoft 365, an administrator can end all active sessions so any attacker who's already logged in is thrown out.
- Check multi-factor sign-in is switched on and that no unfamiliar phone or app has been added to the account.
- Look for hidden mailbox rules. Attackers often create rules that forward copies of email elsewhere or hide replies from the real user. These are easy to miss.
- Review recent sign-ins for unusual locations or times.
- Tell the staff member why it happened, without blame. Most people don't realise reusing a password is a risk.
- Decide if it's a data breach. If personal data may have been accessed, record what happened and consider whether it needs to be reported. If in doubt, take advice.
How to reduce the risk in the first place
You can't stop other websites being breached, but you can make sure a leaked password is worth very little to a criminal:
- Turn on multi-factor sign-in for every user, especially for email and remote access. This single step stops most attacks that rely on stolen passwords.
- Use a password manager so every account has a long, unique password and nobody needs to reuse one.
- Ask staff not to use work email for personal sign-ups.
- Train staff to spot phishing, including fake sign-in pages.
- Monitor Microsoft 365 for suspicious sign-ins, new forwarding rules and unusual activity.
- Keep computers protected and updated to reduce the risk of password-stealing malware.
How CastCom helps
Our dark web monitoring watches for your company's email addresses and tells you exactly which credentials appeared, so you can change them before they're used. We combine it with Microsoft 365 account alerts that look for the warning signs of a compromised mailbox, such as a hidden forwarding rule or a sign-in from a country where you have no staff, and can lock the account straight away.
The bottom line
Most businesses only find out their details were leaked when something goes wrong. Knowing in advance turns a potential breach into a five-minute password change.
Want to know if your company's passwords have leaked? Every Security Health Check includes a dark web check for your company's email addresses, along with a review of your Microsoft 365, computers, email domain and network.