Dark Web Surveillance Alert: What It Means and What to Do

A dark web surveillance alert means a monitoring service found something tied to you, such as an email address, a password or a Social Security number, in a place where stolen data circulates. It is a warning, not proof that someone has already used your data. What matters is how you check the alert, which accounts you secure first, and whether you can make the exposed data useless.

This guide covers all of that: how to tell a real alert from a scam, what to do in the first hour, how businesses should respond differently from individuals, and how to set things up so the next alert is a small event.

TL;DR

• An alert means your data appeared in a leak or a marketplace. It does not mean your accounts were taken over, but treat it as a prompt to act the same day.
• Do not click links or call numbers in the alert itself. The FTC says such messages are frequently phishing. Go to the service directly, or to IdentityTheft.gov.
• Change your primary email password first, then turn on multi-factor authentication (MFA) on every sensitive account.
• Businesses should verify whether leaked credentials are current before forcing resets, then revoke sessions and tokens, not just passwords.
• Passwordless or bound-authenticator MFA is the strongest answer, because a stolen password alone no longer opens the account.

What a dark web surveillance alert actually tells you

The dark web is a part of the internet that standard search engines do not index. Not every site there is criminal, but the FTC notes that it is where sites selling stolen consumer data operate. Dark web monitoring services scan those places, along with breach dumps, and notify you when your details match.

The alert usually reports one of three things:

1. A breach exposure. A company you used was breached and your email and often a password hash or plain password were in the data.
2. An infostealer hit. Malware on a device scraped saved logins, and they now appear in a log being traded.
3. A sensitive identifier. A Social Security number, bank account or driver’s license number was found in a listing.

These carry very different risk. A years-old email address from an old forum breach is a nuisance. A current password for your email account, or an SSN, needs action today.

Why the data is worth money

Stolen data is packaged for convenience. The FTC describes the dark web as a place of “one-stop shopping” for fraudsters, and its guidance mentions marketplace listings that bundle enough information to imitate a real person’s behavior. That is why even a partial exposure can be combined with other leaks to open accounts in your name.

Credentials are also the most common way in. In the 2025 Verizon Data Breach Investigations Report, compromised credentials were the initial access vector in 22% of breaches reviewed. The same research found credential stuffing, where attackers replay leaked logins against other sites, makes up a median of 19% of daily authentication attempts at single sign-on providers.

Is your alert real? Check before you click

Scammers copy the look of monitoring alerts. The FTC has warned about emails claiming your personal information is for sale on the dark web, some even listing partial details like part of a Social Security number, and pushing you to click or call.

Use this quick test:

• Did you sign up for monitoring? If you never enrolled anywhere, an unsolicited alert is suspect.
• Does it ask for money, a payment or a login? A real alert tells you what was found and where. It does not demand payment to reveal it.
• Does it create urgency? Threats about deadlines are a red flag.
• Can you verify it elsewhere? Open the monitoring service by typing its address yourself, or check your own account on a trusted site, rather than using the message’s links.

If you want an independent check, you can run an email through the LogMeOnce dark web email scan and see whether the address appears in known exposures, without trusting a link from an unknown sender.

What to do in the first hour

The FTC’s guidance points to the same order of operations. Here it is, with the reasoning behind each step.

Step 1: Secure your primary email

Your main email account can reset almost every other password you own. Change its password first, make it long and unique, and make sure no one else has added a forwarding rule or recovery address. This is the FTC’s advice too: start with the primary email, then move outward.

Step 2: Turn on MFA everywhere that matters

Email, banking, payroll, cloud storage, and any account that stores payment details come first. An app-based or hardware factor beats a text message. Our overview of two-factor authentication explains the options.

Step 3: Replace reused passwords

If the exposed password is used on other sites, those sites are now at risk too. Attackers test leaked logins widely and quickly. We explain the mechanics in why password reuse is dangerous. A password manager generates a unique password for each account so one leak stays one leak.

Step 4: If a Social Security number was exposed, lock down credit

Go to IdentityTheft.gov, the FTC’s official site, to report and get a recovery plan. The federal guidance on data breaches also tells you to place a credit freeze or at least a fraud alert. Be ready for a few extra steps when you next apply for a card or phone service, because a freeze means lenders cannot check your credit until you lift it.

Step 5: Watch statements and keep notes

Review bank and card statements for the next several weeks. Write down the date of the alert, what it listed, and what you changed. If fraud appears later, that record helps.

For more detail on the aftermath, see our guides on what to do after a data breach and what to do after a password breach.

How serious is it? A simple triage

Passwords can be changed. An SSN cannot, which is why alerts involving government identifiers deserve more attention than those about an old account.

If you run a business: respond differently

An alert about company credentials is a security incident until proven otherwise. The response needs more care than an individual’s.

Verify before you reset everything

A common mistake is panic-driven remediation. CISA’s guidance on ransomware and credential-related incidents supports checking first whether leaked credentials match current systems or legacy ones. Forcing broad resets blindly can disrupt service and lock legitimate users out of VPN or edge devices.

Kill sessions and tokens, not just passwords

A new password does not end a session an attacker already holds. CISA explains in its token countermeasure guidance that blocking and reissuing tokens stops persistence and lateral movement. Stateless tokens such as JWTs cannot be revoked from a server database, so teams must rotate refresh tokens or keep a server-side deny-list.

CISA’s June 2026 alert on exposed credentials for Fortinet devices shows the scale this can reach: it covered about 74,000 edge devices and VPN gateways. Its advice for affected organizations includes ending administrative sessions, resetting credentials and enforcing strong password policy.

Mind the personal-device gap

The 2025 DBIR found that 46% of compromised systems holding corporate logins were unmanaged devices that also held personal credentials. An employee’s home laptop infection can surface as a company alert. Ask staff to report personal-account alerts, because a reused password links the two worlds.

Small businesses are not too small

The same report indicates ransomware appears in 88% of breaches at small and medium businesses, compared with 39% at larger organizations, and that edge-device flaws take a median of 32 days to remediate. See our overview of cyber threats that target small business and the benefits of dark web monitoring for businesses. To see what is exposed for your company’s email addresses, try the dark web domain scan.

Our perspective: an alert is a symptom, not the cure

We see the same pattern with customers. People treat monitoring as the protection, then feel helpless when an alert arrives. But monitoring only tells you that something leaked. It cannot take the data back.

So we think about it in two layers. The first is detection: you want to know quickly, in plain language, what was found and where. The second is making the exposed data worthless. A unique password per account means a leak at one site opens nothing else. A second factor that is not a password means a stolen password alone is not enough.

That is why we push passwordless MFA. NIST’s digital identity guidelines on federation describe high-assurance levels where the user must prove control of a bound authenticator. In practical terms, even if credentials were sold, they cannot be used without the physical device. A passwordless MFA setup moves toward that model. Fewer passwords also means less password fatigue, which tempts people into reuse.

Our honest advice: do not panic at every alert, and do not ignore any. Triage it, fix the one or two things it points to, and then spend your effort on the foundations.

— Mike

Cut the risk before the next alert

• Use a password manager so every account has a unique, generated password. Our Weak Password Cost Report shows what weak habits cost.
• Move to phishing-resistant MFA where sites support it.
• Keep devices clean. Infostealers harvest saved logins, so update software and remove unknown apps. The DBIR research notes that, in the median case, only 49% of a user’s passwords across services were the same as those exposed, which still leaves plenty to rotate.
• Encrypt what you store in the cloud, so a leaked login does not hand over readable files. See cloud storage encryption.
• Add continuous monitoring so you hear about exposure within days, not months.

Monitoring with LogMeOnce

If you want alerts and the tools to act on them in one place, LogMeOnce offers identity theft protection with dark web scan and monitoring. Dark Web Monitoring is $1.67 per month, and the Family Dark Web Monitoring plan is $3.34 per month. A free Premium plan is $0.00 per month, so you can start without paying. For passwords, plans such as Professional, Ultimate and Family are on the password manager page, and teams can compare Teams at $4.00 per month per user and Business at $7.99 per month per user on the business pricing page. All plans are compared on our pricing and comparison page.

FAQ

What does a dark web monitoring alert mean?

It means a service found data matching yours, such as an email, password or ID number, in a breach or a criminal marketplace. It does not confirm that anyone has used the data. Check what type of data was listed to judge how urgent it is.

What do I do if I get a dark web alert?

Verify it without using the alert’s links, change your primary email password, and turn on MFA for sensitive accounts. Replace any reused password. If an SSN was exposed, report at IdentityTheft.gov and consider a credit freeze.

Should I be worried if my info is on the dark web?

Be concerned enough to act, not enough to panic. Old email-only exposures are common and low risk. Current passwords and government identifiers deserve same-day action, because they can enable account takeover or new accounts in your name.

Can I remove my information from the dark web?

No. Once data is copied and traded, you cannot reliably pull it back. Your goal is to make it useless: change passwords, add MFA, freeze credit where relevant, and monitor for misuse.

Sources

• FTC: Did you get an email saying your personal info is for sale on the dark web?
• FTC: The dark web, what your business needs to know
• IdentityTheft.gov: Data breach recovery guide (PDF)
• Verizon: 2025 Data Breach Investigations Report
• Verizon: 2025 DBIR credential stuffing research
• CISA: Hardening Fortinet devices after credential exposure
• CISA: Advisory AA24-046A
• CISA: Token blocking and reissuing countermeasure
• NIST SP 800-63C-4: Federation and Assertions

Recommended

• The Benefits of Dark Web Monitoring for Businesses