THREAT INTELLIGENCE
Is your data for sale on the dark web? How to find out
Company passwords, customer databases and access are traded every day on underground forums. Learn what is usually sold, how monitoring works and how to respond to each kind of finding.
IN 30 SECONDS
- Credentials, customer databases and ready-made access are the top sellers.
- Monitoring validates every finding before raising an alert.
- A leaked password gets reset the same day, with MFA on.
- A personal data breach may require notifying the ANPD.
Employee passwords, customer databases and system access are sold every day on dark web forums and channels. Many companies only find out about a leak once the data has already been used — in a scam against customers or in an intrusion.
What is usually for sale
- Corporate credentials
Email, VPN and system logins, often captured by malware on personal computers (infostealers). - Customer databases
Names, ID numbers, phone numbers and purchase data, later used in very convincing scams. - Ready-made access
Criminals sell access to an already-breached network to whoever will deploy the ransomware. - Executive data
Personal information used in fake-executive scams and targeted attacks. - Scam kits using your brand
Cloned pages and ready-made scripts to deceive your customers.
How monitoring works
- Define what to look for
Domains, brands, executive names, IP ranges and business keywords. - Sweep the sources
Underground forums, illegal markets, closed channels, paste sites and large leaks. - Validate the finding
Analysts confirm whether the data is real, recent and actually linked to the company. - Alert with context
The alert says what was found, the risk and what to do first. - Investigate what is critical
When needed, we investigate the source, scope and those involved, with evidence preserved.
| Finding | Recommended response |
|---|---|
| Employee password leaked | Immediate reset, sessions ended and MFA |
| Customer database for sale | Breach audit, root cause and assessment of ANPD notification |
| Lookalike brand domain | Evidence collection and takedown request |
| Network access advertised | Immediate incident response |
Mind Brazil’s data protection law (LGPD)
If the company’s personal data has leaked, there may be an obligation to notify the authority (ANPD) and the people affected. The breach audit shows the exposed volume and the root cause, which support that decision.
Quick checklist
- Domains, brand and executives monitored
- MFA on email, VPN and critical systems
- A process to reset leaked passwords the same day
- A breach response plan with the legal team
- Customers briefed on scams that use your brand
HOW CiBER DETETiVE CAN HELP
Threat Intelligence & Dark Web
Continuous deep and dark web monitoring to detect leaked credentials, data for sale and scams using your brand.
For information only. This does not replace a professional review of your specific case. Legal references reflect the rules in force on the publication date (Brazilian law).