Data breaches have become a fact of our digital world. Verizon’s 2025 Data Breach Investigations Report recorded over 12,000 breaches in that year alone. That’s nearly three dozen a day.
And it gets worse. Troy Hunt, founder of Have I Been Pwned, says that data breaches are not being reported as openly as they once were. “Now more than ever, there is an abundant lack of disclosure from breached organizations.”
There is, however, one last line of defense: a dark web monitoring service. Here’s what they are, how they work, and which ones we prefer. While you’re at it, consider looking into identity theft services, which can provide insurance for lost money online.
What Do Dark Web Monitoring Services Do?
Hunt says that, contrary to the name, dark web monitoring services aren’t necessarily focused on the dark web—parts of the internet available only through specialized software such as a Tor web browser.
“Most of the time when data is available, it’s not the dark web, it’s the clear web,” says Hunt. While it’s true that data might also be shared on the dark web, the vast majority of compromised data is found on publicly accessible hacker forums and markets.
The availability of the data is what makes a so-called dark web monitoring service, also known as a data breach monitoring service, possible.
It’s essentially a database of data breaches the service has found online. You sign up for the service by providing your personal data. An email address is most common, but some may also ask for a phone number or even your credit card information. The monitoring service can then alert you to any existing matches in its database and send you a notification if any new breach occurs in the future.
If the data is out there, the odds are good that it’s been reported. The infrastructure feeding breaches into modern dark web monitoring databases is extensive and sophisticated.
Law enforcement sends Have I Been Pwned “a lot of data,” says Hunt. “The FBI has an ingestion pipeline where they can feed passwords in.” Sources in the Infosec industry also often share data with each other, and in some cases, the hackers themselves reach out.
A Wide World of Stolen Data
The wide circulation of breached data is a silver lining to an otherwise dark cloud. Individuals have essentially zero power to control or avoid the breaches that leak personal data. But once the data is leaked, it rarely stays a secret for long.
