The Dark Web - Stolen Data and Hidden Markets

About 2 min read

The dark web is a part of the internet that cannot be accessed with an ordinary browser and is reachable only through anonymizing networks such as Tor. Because of its high degree of anonymity, it has become a breeding ground for illegal activity, including the trade of leaked passwords and personal information and the sale of malware. On the other hand, it is also used to share information in countries where freedom of speech is restricted. In 2024, the operation of leak sites on the dark web by ransomware groups grew even more active, and the damage from double extortion increased.

Dark Web Monitoring for Early Leak Detection

While the dark web is a hotbed of crime, for defenders it is also an observation point for detecting leaks early. In threat intelligence practice, black markets and forums are continuously monitored for data related to one's own organization being bought or sold. Finding a list that appears to contain your customer data up for sale can be the first sign that a breach has occurred; in that case, the response proceeds to verifying the list's authenticity, identifying the source of the leak, and initiating incident response. The value of this monitoring lies in the fact that even a breach that slipped past internal detection can come to light through traces that surface externally.

Historical Background

Tor (The Onion Router), the foundation of the dark web, originates from anonymous communication technology developed by the U.S. Naval Research Laboratory in 2002. It was initially intended to protect government communications, but in 2011 the black market "Silk Road" appeared, and the criminal use of the dark web became widely known. Although Silk Road was shut down by the FBI in 2013, successor black markets such as AlphaBay and Hansa Market subsequently emerged one after another. Ransomware groups set up leak sites on the dark web and use them as a means of pressure known as "double extortion," publishing the data of victims who refuse to pay the ransom.

The Dark Web and Password Leaks

Passwords leaked through a data breach are bought and sold on marketplaces on the dark web. Billions of account credentials are compiled into lists and used in credential stuffing attacks. Leaked passwords can sometimes circulate on the dark web within just a few hours.

How to Protect Yourself

The most effective countermeasure is to use a different random password for each service. Even if one service is breached, the others are not affected. It is also important to regularly check, using services such as Have I Been Pwned, whether your email address is included in any leak lists.