Is your data circulating on the dark web? A monitoring guide for small businesses

A small business often has neither an IT department nor a cybersecurity budget worth the name. Yet it is the most exposed. According to ANSSI, the French cybersecurity agency, very small, small and medium-sized businesses make up 58% of the ransomware victims it records. And a significant share of small organisations hit by a serious cyberattack never recover.

These attacks do not come out of nowhere. Very often, they start with a stolen credential: an employee’s email password, VPN access, an admin account for an online tool. This data is traded on the dark web, sometimes months before a criminal uses it. Hence the value of “dark web monitoring”, a service that consists of spotting these leaks in time. Here is how it works, what it costs and, above all, what to do when an alert comes in.

The dark web, a market for stolen access

The dark web refers to sites that can only be reached with specialised software, such as the Tor browser, which hides where connections come from. It hosts closed forums and marketplaces where databases, credentials and access to corporate networks are sold. But the trade in stolen data is not limited to it: a good part also takes place on the ordinary web, on file-sharing sites and on messaging channels such as Telegram.

A growing share of recent data comes from “stealer logs”, the output of information-stealing spyware. Installed on a computer, often a personal one, through fake software or a booby-trapped attachment, these programs vacuum up the passwords saved in the browser and session cookies, then send them to their operators, who resell them in batches. An employee who checks their work email from an infected family computer can thus expose the company without knowing it.

How monitoring works

Monitoring services rely on crawlers that continuously explore these marketplaces, forums, file-sharing sites and messaging channels. The content collected is compared against a watch list built from the company’s domain name and its employees’ email addresses. When a match appears, an alert is issued.

The most advanced tools use machine learning to sort through huge volumes of conversations, in several languages, and isolate the sensitive cases. Serious providers have an analyst check matches before warning the client, to weed out false positives. A good alert states the type of data found, where it was spotted and an estimated date for the leak.

Affordable options, including a free one

There is no need to start with an offer costing several thousand euros. Have I Been Pwned, created by Australian researcher Troy Hunt and now a global reference, lists billions of accounts from public leaks. It offers a search by domain name: after proving it owns the domain, a company can see which of its employees’ addresses appear in known leaks. The service is free as long as fewer than ten addresses on the domain are affected. Beyond that, subscriptions start at around $4 a month for one domain and up to 25 compromised addresses, and rise to several hundred dollars for unlimited or multi-domain plans.

Other solutions specifically target small organisations. In France, the Lyon-based start-up Mia, cited by Clubic, detects work addresses in recent leaks and spots the creation of unauthorised accounts on tools such as Slack or Microsoft using the company’s credentials. Consumer security suites also include dark web monitoring, limited to a few addresses: a first step for a freelancer. Platforms for growing businesses add detection of spoofed domains and source code leaks, billed per employee. Offers for large companies often exceed ten thousand euros a year, out of reach for a small business.

• Free: domain search on Have I Been Pwned (fewer than ten compromised addresses), breach notifications.
• A few euros a month: entry-level subscriptions, monitoring included in security suites.
• Growing businesses: platforms billed per employee (spoofed domains, code leaks).
• Large companies: offers above ten thousand euros a year, with dedicated analysts.

Reading an alert: not all leaks are equal

A monitoring tool is useless if you do not know how to interpret its alerts. An address found in an old, well-known and widely circulated database carries limited risk, especially if the password has been changed since. Data freshly extracted from a spyware log is a different matter altogether: it signals an active infection, with credentials and session cookies that may still be valid.

Two criteria therefore matter above all: the date of the leak and the technical origin of the data. A password alone weighs less than a credential tied to VPN access, an admin console or a financial management tool. A single alert does not mean an attack is under way; the risk rises if it coincides with unusual login attempts or phishing messages aimed specifically at employees. It is worth cross-checking the alert against login logs to see whether the credential has been used recently.

Watch out for dormant accounts too. An employee who left months ago may still have an active account on a business tool. According to a Verizon report cited by Mia, this kind of forgotten account is involved in 40% of the data breaches observed in companies.

What to do, in practice

The right responses are simple, and most can be put in place without waiting for the first alert.

• Immediately change any flagged password, as well as any identical ones used elsewhere.
• Turn on two-factor authentication for critical tools, starting with email and remote access; physical security keys are the strongest option.
• Roll out a password manager for the whole team, rather than reused combinations.
• If a spyware log is involved, revoke open sessions and have the computer concerned checked.
• Warn affected employees so that they also check their personal accounts linked to the address.
• Every quarter, review the accounts of employees who have left and close those still open.
• Document each alert and the response given, which is useful in case of an audit or an insured loss.
• Check that backups are isolated from the main network.

Where to find help

In France, the public platform Cybermalveillance.gouv.fr helps assess how serious a leak is and report an incident. Its 2025 activity report shows the scale of the problem: more than 500,000 victims assisted, up 20% in a year, and requests from businesses rising sharply. Account hacking is the top threat reported by professionals, up 45%, and reports related to data breaches have more than doubled. These serial leaks feed directly into the markets that the tools described above monitor.

Monitoring is not enough, but it helps you act in time

Dark web monitoring does not prevent a leak: it lets you find out about it before a criminal exploits it. For a small business, the best strategy combines a monitoring tool suited to its budget, often free to start with, and rigorous basic hygiene. A stolen credential that is protected by two-factor authentication, an account closed when an employee leaves, an offline backup: these simple steps turn a worrying alert into an incident without consequences.