Skip to main content
The dark web is the part of the internet that search engines do not index. Much of it hosts marketplaces and forums where data stolen in breaches is sold or shared: email addresses, passwords, phone numbers, home addresses, and financial details. A dark web scan checks those sources for data tied to a client’s domains and people.

​
What Telivy finds

Every Telivy assessment includes a dark web scan of the client’s domains. Results appear under Dark Web on the assessment’s Security tab, in the Dark Web Data table, and the Dark Web Presence card on the Overview summarizes them. A leaked record can include usernames, passwords, IP addresses, email addresses, physical addresses, and phone numbers. On a Risk Assessment, Telivy also checks the passwords saved in employees’ browsers against breach data and lists matches under Browser Credentials on Dark Web. See Identity and Access Management. To hide leaked passwords in results and exports, turn on Mask Dark Web Passwords in the assessment’s PII settings. See Data Security.

​
Why it matters

Stolen credentials are the cheapest way into a company. Attackers try leaked email and password pairs against Microsoft 365, VPNs, and other logins, and they work whenever someone reused a password or never changed it. A leaked email address with a name and phone number is also enough to build a convincing phishing message. A dark web scan tells you which accounts are already exposed, so you can reset them before someone uses them. For a prospect, it turns a general warning into a list of their own exposed accounts.

​
How severity is judged

Some leaks are more urgent than others. Four things decide how serious a finding is:
  • What leaked. A password, especially in clear text, is worse than an email address alone.
  • How recent it is. Telivy grades a client lower when leaks are recent. Findings from the last two years count most, and leaks older than five years count least. See Telivy Grading Criteria.
  • Whose account it is. An administrator or finance account matters more than a former intern’s.
  • Whether the password is still in use. A leaked password that matches one still saved in a browser is an active risk.

​
How leaked data gets used

Leaked credentials lead to account takeover through credential stuffing, where attackers try the same password on many services. Leaked personal details feed targeted phishing and business email compromise, and both can end in fraud, ransomware, or more data theft. A company that appears in one breach is also more likely to be targeted again.

​
Remediation

  1. Reset the password for every account with a leaked password, and anywhere else the same password was used.
  2. Turn on MFA for those accounts, starting with administrators and anyone who handles money.
  3. Check sign-in logs for the affected accounts for unusual locations or failed attempts. For Microsoft 365 clients, the Microsoft 365 Security view shows these.
  4. Tell the affected users, and use the finding in security awareness training so people recognize the phishing that usually follows a leak.
  5. Keep scanning. New breaches surface all the time, and Risk Monitoring alerts you when new leaks appear.
Do not try to access dark web marketplaces yourself to check a client’s data. Much of what happens there is illegal, and visiting carries real legal and security risk. Telivy collects the data for you.