The dark web may seem like a wild and lawless place, but a team of police officers in the north of England are getting creative to bust dark web crime. They’ve found ways to successfully identify criminals selling personal data, fake COVID-19 vaccines and child sexual abuse images.
These ongoing advances in digital law enforcement show those who use the dark web for harmful activity are by no means safe. But too many businesses don’t know what they can do to avoid having data stolen and sold on the dark web, and reduce the impact if it happens.
What is the dark web, and why should business care?
The dark web is a network of computers where web traffic is anonymized. Many use it to access marketplaces and other sites to commit crime.
Alongside illegal drugs, counterfeit goods and weapons, selling personal data is big business on the dark web. Fraudsters can buy names, dates of birth, credit card information and more.
The FBI reports losses from fraud topped 4 billion US dollars in 2020.
Find a cyberattack's source
Who hacked you?
Cybercriminals don’t leave a calling card, but they do leave evidence.
Because cybercriminals often go to the dark web to sell their ill-gotten data, businesses can reduce the time it takes to discover a data breach, costs and reputation damage with dark web monitoring. Kaspersky research found in 2021, the average cost for enterprises of a third-party data breach reached 1.4 million US dollars.
What cybercriminals do with data on the dark web
Much of its content is illegal but the dark web itself isn’t. The dark web has legitimate uses: Dissidents, whistle-blowers and investigative journalists use it to communicate anonymously online. Others use it to avoid websites collecting their data.
It uses the same infrastructure as the public internet, but you need special software like Tor (‘the onion router’) browser to access it. Servers connected to the dark web hide behind many layers of anonymity. Criminals also use cryptocurrencies like Bitcoin to hide transactions.
Cybercriminals mostly attack for financial gain, and the dark web presents the perfect place to profit from stolen data. Sometimes, they hold victims to ransom, threatening to publicly expose their stolen materials – anything from explicit photos to bank account details.
Dark web monitoring services: Are they worth it?
Dark web monitoring services are often hyped after catastrophic data breaches. Consumer credit reporting firm Experian saw these breaches as a market opportunity, launching a dark web monitoring service.
Many companies now offer dark web monitoring, but there’s widespread misunderstanding of if and how it works.
These services don’t scan the full dark web – that would be almost impossible. Nor do they start takedown proceedings regarding stolen records or intellectual property. Once something is on an underground marketplace, there’s often nothing you can do to stop it being sold or misused.
Dark web monitoring can only detect publicly available information – scanners can’t see anything shielded from scraping software. They’re looking for big data dumps containing leaked personal information like passwords and card details. If cybercriminals steal your business information stolen and put it on the dark web, a dark web monitoring service will inform you, but only if they can see it.
Are there better ways than dark web monitoring?
There are many more effective ways to protect your business from dark web criminals, like encrypting all your data and educating employees on how to avoid accidentally giving cybercriminals access.
But if you’ve had a breach, it’s time to face facts: Your data is already stolen. If your sensitive information ends up on the dark web, monitoring may let you identify the breach and alert those whose information was stolen faster.
Dark web monitoring also offers value by keeping business decision-makers informed of trends in underground communities that might compromise their security. For example, a monitoring service could reveal chatter about targeting a particular company in dark web forums, giving you a chance to prevent a breach.
Business leaders looking for more reliable ways to tell if they’ve been hacked will be pleased to know some methods don’t demand a monthly fee. Have I Been Pwned tells you if your email addresses or associated accounts are compromised.
In the end, the only truly reliable way to find out if you’ve been hacked is to keep audit trails of activity across your network and every device connected to it. High-tech security solutions today, rather than just detecting known threats, let you search for suspicious activity like unusual computing tasks, strange network connections or unwanted software installations.
No information security infrastructure is 100 percent unbreachable. If your organization does fall victim to a data breach, the sooner you learn of it, the better. A multi-layered, proactive approach to cybersecurity with full, real-time visibility of your digital assets is the best way to safeguard your business and customers.
