A dark-web alert is an exposure signal, not a verdict. It almost always means a company you did business with was breached and the stolen records — your email, and often a password, phone number, date of birth, or more — were posted or sold on a criminal forum. That is worth taking seriously. It is also frequently misread: many alerts point to old, recycled breach collections that were already mitigated by a password you changed years ago, and some scans overstate the danger to sell a subscription. The first job is always to separate a fresh, actionable exposure from stale noise.
What a forensic review does that a free scan can't
A free scan answers one question — does your email appear in a known breach — and stops. Tools like Have I Been Pwned do that well and for nothing, and they are a sensible first check. A forensic review begins where the scan ends:
- Verify the exposure. Match the leaked record against known breach corpora, date it to a specific incident where possible, and identify exactly which fields were exposed — an email alone is low-risk; an email plus a reused password is urgent.
- Interpret the risk. Determine whether the exposed credentials are still valid on any account you hold, and which of your accounts the exposure actually threatens. Proportionate action beats panic.
- Preserve the evidence. Capture the posting or listing with its context and timestamps and preserve it under a defensible chain of custody, so if the exposure turns into fraud, extortion, or identity theft, you have documentation designed to support a police report, an FBI IC3 complaint, or an insurance or identity-theft claim.
- Harden what's at risk. Rotate exposed and reused passwords, move two-factor authentication to an app or hardware key, freeze credit where financial data or a Social Security number was involved, and reduce the public attack surface that made you a target.
What we don't promise
We do not claim to name the person who leaked your data or to remove it from the dark web — data that is already circulating on criminal forums cannot be deleted, and anyone who guarantees otherwise is selling a false promise. Attribution on dark-web forums is the work of agencies with subpoena power; our role is to produce the evidentiary record that lets them act. What we deliver is an analyst's honest read of what your exposure means and a defensible record of it — not a scare banner and not a guarantee.
Ongoing monitoring, so the next exposure reaches you fast
A one-time review tells you where you stand today. Continuous monitoring is what turns the next breach from a months-late surprise into an alert you get in hours. Our Protections layer watches for new breach and credential exposures and routes them into the same forensic response workflow, and every discovery can be preserved in the Evidence Vault with its chain of custody intact.
