Responding to Dark Web Email Breaches

What a dark web breach is

A dark web breach is a set of email addresses and passwords from your domain that surfaced when another company you or your team held an account with was breached. Those credentials get dumped and traded on criminal forums. The old account isn't really the problem - password reuse is. Attackers take a known email-and-password pair and try it against your email, banking, and business apps, an automated attack called credential stuffing. A login that still works gets them in without tripping any alarm.

Why it's a real risk

Stolen credentials remain one of the most common ways attackers get a foothold. The 2025 Verizon Data Breach Investigations Report found that the use of stolen credentials is a leading initial-access route, and that roughly 60% of breaches involve a human element. No firewall stops a valid username and password.

How to fix it

1. Reset the exposed passwords. Start with the accounts in your report. Current NIST guidance (SP 800-63B) favors long passphrases over forced complexity and says a password only needs changing when there's evidence it's compromised - a dark web hit is exactly that evidence.
2. Stop reusing passwords. Use one unique password per account, stored in a password manager. NIST also recommends screening new passwords against known breached-password lists.
3. Turn on Multi-Factor Authentication (MFA). CISA rates MFA as one of the most effective single steps you can take - even a correct password fails without the second factor.
4. Brief your team. A two-minute heads-up stops the same exposure from recurring.

How to confirm it's fixed

Re-run your Cyber Score - the Compromised Accounts list should shrink as resets take effect. Where a service offers sign-in history, check it for logins you don't recognize. Open the Compromised Accounts tab in your Cyber Score to see which logins to reset first.

Sources

• NIST SP 800-63B - Digital Identity Guidelines (passwords and MFA)
• CISA - Multi-Factor Authentication
• Verizon 2025 Data Breach Investigations Report