Dark Web Monitoring: Darknet Monitoring for Companies

What is Dark Web Monitoring?

Stolen data is sold, swapped or made public. This often happens in places that normal search engines cannot find. Dark web monitoring searches these places all the time. It matches the findings against traits of your company, such as your domain or company name.

The goal is time. The sooner you know about a leak, the sooner you can lock accounts and inform the people affected. Without monitoring, many companies only find out through an attack or from a third party.

Dark Web, Deep Web and Surface Web

You can roughly split the internet into three layers:

• Surface web: everything search engines can find, such as websites and news sites.
• Deep web: content behind a login, for example mailboxes, customer portals or company intranets. This content is mostly perfectly legal.
• Dark web: a deliberately hidden part. You can only reach it through anonymization networks such as Tor. Many forums and marketplaces for stolen data are found here.

Read more about how it is built and where it came from in the glossary entry Dark Web.

How Does Company Data End Up on the Darknet?

• Ransomware with data theft: Many groups steal data before they encrypt systems. If the victim does not pay, the data lands on a leak site. Read more under Ransomware.
• Malware on devices: So-called infostealers read saved passwords and session data from the browser. This also affects private devices that staff use to access company accounts.
• Data breaches at service providers: If a web shop, a supplier or a cloud service is hacked, your accounts there are often affected too.
• Phishing: Fake login pages collect login data. It is later sold in bulk.

Such collections turn into long lists of email addresses and passwords. Attackers test them automatically against many services. This is called credential stuffing.

What is Monitored?

For companies, these traits matter most:

• Domains: all email addresses and logins that end in your company domain.
• Company and brand name: for example in the victim lists of ransomware groups or in sales offers.
• Accounts of key people: management, admins and the finance team are popular targets.
• Systems and access: for example access to your VPN or remote maintenance offered for sale.
• Customer and staff data: records that come from your systems.

Services for private users usually only check single email addresses, phone numbers or credit cards.

How Does Dark Web Monitoring Work?

1. Collect: The service watches sources such as leak sites, forums, marketplaces and messenger channels. It stores new posts and data sets.
2. Match: It searches the findings for your traits, for example your domain.
3. Rate: Not every hit matters equally. A new plain-text password weighs more than a known finding from five years ago.
4. Report: Relevant hits go to your team as an alert. Good services include the source, date and type of data.

Monitoring is part of threat intelligence, which means knowledge about attackers and their methods. You can link it with threat intelligence feeds and a SOC.

What to Do When You Get a Hit

A hit is only useful if you react fast and in order. These steps have proven themselves:

1. Assess: Which data is affected? How old is the finding? Does it come from your own systems or from a service provider?
2. Secure access: Reset passwords, end open sessions and lock affected accounts if needed.
3. Check the second factor: Is multi-factor authentication on for all affected accounts?
4. Find the cause: Is there an infected device or an ongoing attack? Then your incident response plan applies.
5. Check reporting duties: If personal data is affected, you may have to report to the supervisory authority (see below).
6. Warn the people affected: Staff and customers should know to expect targeted phishing.
7. Document: Record what you found and what you did, and when.

Limits of Dark Web Monitoring

• No full view: Closed forums and private channels are only partly visible. No service finds everything.
• It reports, it does not prevent: When data shows up on the darknet, the theft has already happened.
• No deletion: Data that has been published can hardly be taken back.
• Old findings and false alarms: Many hits come from known, older leaks. Without rating them, alert fatigue sets in.

Dark web monitoring therefore adds to basic protection such as updates, backups, password rules and training. It does not replace it.

Data Protection and Reporting Duties

Leaks almost always contain personal data. If you download and analyze them, you process this data. You need clear rules for that: Who may see the findings? What are they used for? When are they deleted? Involve your data protection officer from the start.

If the data comes from your company, you are usually dealing with a data breach. Under Art. 33 GDPR, you report it to the supervisory authority within 72 hours of becoming aware of it. If there is a high risk to the people affected, you must inform them under Art. 34.

If your company falls under NIS-2, extra reporting deadlines to the BSI apply to significant security incidents: early warning within 24 hours, notification within 72 hours, final report within one month. NIS-2 does not require dark web monitoring. But it can be the first sign of such an incident.

Dark Web Monitoring with SecTepe

SecTepe.Core has two building blocks for this topic:

• SecTepe Leak-Ingest: checks the victim lists of leak sites against your domain and company name every day. Once your data protection officer approves, the module analyzes the leak. It finds the people affected and prepares the notification under Art. 33 and 34 GDPR.
• Threat intelligence in SecTepe.Core: matches your domains and mail addresses against threat feeds. Hits show up as an alert for your tenant.

Conclusion

Dark web monitoring tells you when your company data is in the wrong hands. It does not stop an attack. But it shortens the time in which attackers can use stolen data unnoticed. It is most useful when it is clear who rates hits and what happens next.