Explainer · checked 13 October 2026

Dark web monitoring for small businesses

"Dark web monitoring" sounds like someone patrolling hidden websites. In practice it means checking big databases of leaked logins and breach dumps for your company's email addresses, and alerting you when new ones appear.

Check my domain free

Where leaked company data comes from

• Breaches of other websites. A staff member signs up to a service with their work email; that service is hacked; the email and password end up in a dump that gets shared and sold.
• Infostealer malware. A laptop gets infected and the malware sends off every saved browser password and login cookie. These "logs" are sold in bulk and are now a leading cause of account takeovers.
• Breaches of your own systems. Your website or a supplier holding your data is hacked.

How legitimate monitoring works

Reputable services don't buy stolen data from criminals. They use breach-notification databases such as Have I Been Pwned, which collects publicly circulated breach data and lets verified domain owners see which of their addresses appear. You prove you own the domain first, so nobody can look up someone else's staff.

Enterprise tools such as Kaseya's Dark Web ID, SOCRadar and others are usually sold through IT providers or on annual contracts. A small company can get most of the value from a verified domain search plus alerts.

What to do when staff emails show up

1. Reset that person's password everywhere they reused it, starting with email.
2. Turn on two-factor login for email, banking and admin accounts. This stops most attacks that use leaked passwords.
3. Use a password manager so every site has a different password.
4. If the leak came from malware, clean or wipe that device and sign out of all sessions.

Fix the other half too

Leaked passwords let criminals get in. Weak email settings and lookalike domains let them pretend to be you. Our free check covers both of those today; leaked staff email alerts are part of monitoring.