Getting an alert that your business information has been found on the dark web is unsettling. It might be employee email addresses and passwords, customer data, financial details, or internal documents. The important thing to know is that a dark web finding is a warning, not necessarily a breach of your own systems. Many exposures come from third-party sites where employees used their work email. Acting quickly and calmly limits the damage.
Here are the steps to take, in order.
Step 1: Understand What Was Found
Review the alert details. Determine:
- What type of data was exposed: email addresses, passwords, personal information, payment data, or company files
- Which accounts or people are affected
- Where the data came from, if known, such as a third-party breach
- How recent the exposure is
An old password from a breached shopping site is very different from a recent dump of your customer database.
Step 2: Reset Exposed Credentials Immediately
For any exposed username and password, reset the password on the business account right away, along with any other accounts where the same password was used. Require a strong, unique password generated by a password manager. Do not wait to confirm whether the password is still valid.
Step 3: Confirm Multi-Factor Authentication
Make sure every affected account has MFA enabled, then extend MFA to every account in the company if it is not already required. MFA prevents most attackers from using stolen passwords even when they have them.
Step 4: Look For Signs Of Misuse
Review recent activity for affected accounts:
- Sign-ins from unusual locations or devices
- New mailbox rules forwarding or deleting messages
- Unexpected password reset emails or MFA prompts
- Changes to payment details or vendor information
- Large file downloads or new sharing links
If you find suspicious activity, treat it as a security incident and move to Step 6.
Step 5: Identify The Source
If the data came from a third-party breach, determine what business information was shared with that service and whether employees should stop using it. If the data appears to come from your own systems, such as internal documents or customer records, that points to a possible compromise that needs investigation.
Step 6: Escalate If Your Systems Were Involved
If there is evidence your environment was breached:
- Contact your IT or security provider to investigate and contain the incident.
- Notify your cyber insurance carrier promptly. Many policies require early notice and approved vendors.
- Preserve logs and evidence. Do not wipe systems before they are examined.
- Consult legal counsel about notification obligations to customers, regulators, or partners.
Step 7: Protect Customers And Partners
If customer or partner information was exposed, consider warning them about possible phishing or fraud attempts using that data. Be careful to coordinate messaging with counsel when a formal breach may be involved.
Step 8: Watch For Financial Fraud
If financial details were exposed, monitor bank accounts closely, alert your bank, and verify any payment change requests by phone. Business email compromise often follows credential leaks.
Step 9: Reduce Future Exposure
- Require a business password manager and unique passwords
- Discourage using work email for personal accounts and sign-ups
- Provide security awareness training focused on phishing and password reuse
- Enable alerts for risky sign-ins in Microsoft 365
- Keep continuous dark web monitoring in place for early warning
Step 10: Document What Happened
Record what was found, what actions were taken, and when. This documentation helps with insurance, compliance audits, and future incidents.
Monitoring Gives You A Head Start
The value of dark web monitoring is time. Finding exposed credentials before an attacker uses them lets you close the door first. Combined with MFA and endpoint protection, it significantly reduces the chance a leak turns into a breach.
CTS Companies provides dark web monitoring in Michigan, with alerts reviewed by our team and clear guidance on next steps. If you need help responding to an exposure, talk to an expert today.