Buying and selling usernames and passwords on the Dark Web is big business. If you know your data is out there, you can make it less valuable. Dark Web monitoring can help you stay one step ahead of the bad guys.

The Dark Web is Real

The Dark Web is a large part of the internet that isn’t visible to search engines. In fact, the Dark Web is estimated to be 550 times larger than the surface Web and growing.

Search engines like Google, Bing and Yahoo only search .04% of the indexed or “surface” internet according to Dark Web ID.  The other 99.96% of the internet consists of databases, private academic and government networks, and the Dark Web.

Dark Web activity is anonymous, so it’s very appealing to cybercriminals.  It’s estimated over 50% of all sites on the Dark Web are used for illegal activities, including the disclosure and sale of digital credentials.

How Data Ends Up on the Dark Web

It’s easier than you may think.  When cybercriminals hack networks, their main goal is often to get information they can sell.  And, small businesses are not immune from the risk.  Bad guys exploit weaknesses like these:

• A careless user entering a username and password into a phishing email. Over 50% of all network intrusions are caused by compromised user credentials.
• Virtually limitless opportunities for theft.  Credentials are used everywhere, including HR and payroll tools, email, CRM, e-commerce, banking and finance, social media, and collaboration tools.
• The exponential potential damage from stealing a single username and password combination. Why? Because users often repeat the same password for multiple services, including network login, social media, and cloud applications.
• Too many old passwords. 47% of accounts are using a password that hasn’t been changed in 5 or more years. If that password is stolen, it’s likely used on many other accounts that would be easy to hack.
• Users who can’t stop clicking on emails.  4% of malware is delivered via email, and many users are still too trusting. (Here’s how to spot a suspicious email.)
• Compromised credentials go unreported for an average of 15 months after the breach occurs. So, cybercriminals have time to test stolen credentials on all types of online accounts before they’re likely to be discovered.

What a Cybercriminal Can Do with Stolen Credentials on the Dark Web

Usernames and passwords represent the keys to the kingdom for malicious attackers.  And, criminals who know how to penetrate a company’s defenses can easily steal hundreds or even thousands of credentials at a time.

With stolen credentials, an attacker can:

• Send spam from compromised email accounts
• Deface web properties and host malicious content
• Install malware on compromised systems
• Compromise other accounts using the same credentials
• Exfiltrate sensitive data (data breach)
• Steal your identity

Far too often, companies that have had their credentials compromised and sold on the Dark Web don’t know it until they’re informed by law enforcement. By then, it’s too late to try and minimize the damage.

How Dark Web Monitoring Can Help

With every publicized (and non-publicized) breach, your usernames and passwords could end up for sale on the Dark Web.

Dark Web monitoring is a credential theft awareness service. You can monitor your identity information on the Dark Web and receive notifications if your information is found online.  From there, you can notify your staff of the exposed information and they can change their passwords immediately.

Contact us for a free, one-on-one Dark Web credential search to learn more.  While you can’t remove stolen credentials from the Dark Web, you can make them invalid and therefore less valuable.  And the sooner you know, the better.