SafeWeb Business

The dark web is a concealed part of the internet where sensitive data can be bought and sold.

Your company’s sensitive data may include information relating to:

• Your clients
• Your employees
• The business itself

Cybercriminals on the dark web are known to use breached information from both individuals and businesses to commit identity fraud.

Personal information, financial data, demographic data, device-specific data, online behaviours data, and purchasing behaviours are all of interest. The more data that a cybercriminal has on an individual or business, the more sophisticated the attempted identity fraud will be.

Statistics show that credit card numbers, for example, can be purchased for as little as $9 on the dark web. Sets of payment data can be bought for $270.

Any and all breached company data on the dark web leaves your business exposed to risk. Identifying information breaches early on gives you the chance to minimise the damage to your company.

The World Wide Web can be better understood by describing three key sections:

1. The surface web
2. The deep web
3. The dark web

The surface web
The surface web makes up around 5% of the internet and is made up of open-access web pages indexed by search engines such as Google, Safari and Chrome. This is the version of the web that most of us use on a daily basis.

The Deep Web
The deep web (also called the invisible web or hidden web) is much larger, taking up around 90% of the web. It contains pages such as password-protected webmail, internet banking or any sort of forum that requires registration for viewing.

The Dark Web
The dark web, which makes up another 5% of the internet, is a collection of hidden websites that sit within the deep web. It is highly encrypted and not accessible via regular search engines. Breached data can end up here.

Why the dark web isn’t always bad

It’s important to be aware that the dark web can be a risky place for your business data. The high level of privacy and anonymity of the dark web makes it a breeding ground for criminal activity such as identity fraud and the selling of illegal wares.

However, it’s also vital to know that the anonymity of the dark web can be beneficial in certain contexts. For instance, it can provide a lifeline to individuals living under oppressive regimes that block free internet usage or punish political dissent. It is also a critical whistle-blowing and communication tool that shields people from retribution in the workplace. Most major newspapers hold a hidden website on the dark web for this reason.

A data breach is a security incident in which information is accessed without authorisation.

Breached company data that exists on the dark web is open to exploitation by cybercriminals and can result in identity fraud — which can be disastrous for businesses. The resulting reputational and financial cost can take considerable time to repair.

When a data breach is detected, it is essential to take action to prevent criminal activity against your clients, employees and business. However, the specific steps to take depends on the type of data that has been breached.

Take a look at our Support page for a more in-depth look at what to do if your company data is found on the dark web.

The terms ‘data breach’ and ‘data leak’ are often used interchangeably. Both indicate that somebody has unauthorised access to sensitive information. There are, however, differences between them.

So, what makes a data leak different from a data breach? A data breach is a deliberate act, where a cybercriminal sets out with the intention to steal data. A data leak is not deliberate. Sometimes, data leaks happen accidentally. An organisation may accidentally expose sensitive data due to inadequate security protocols, for instance.

Occasionally, a data leak might occur because a cybercriminal finds an existing weakness and acts upon it. This doesn’t count as a data breach because there was no force.

Either way, both data leaks and breaches lead to compromised data that could end up on the dark web.

The UK General Data Protection Regulation (GDPR) came into force in 2018 and outlines the legal responsibilities that businesses have to protect the data of their clients and employees.

The GDPR also stipulates that UK businesses must take certain actions in the event of a data breach. These include:

• Informing the Information Commissioner’s Office (ICO) within 72 hours that a data breach has occurred.
• Informing the affected individuals that the data breach has occurred.
• Ensuring robust breach detection measures are in place within the business.
• Keeping a record of any personal data breaches that take place.

The GDPR and ICO websites give clear information on the legal responsibilities of businesses following a data breach. It’s a good idea to familiarise yourself with this information so you can be prepared in the case of a data breach.

With SafeWeb’s Dark Web Monitoring you can be confident that any sensitive company data that is exposed on the dark web will be found. SafeWeb will notify you if your company data is found on the dark web and direct you regarding the immediate steps you should take.

You have 72 hours to report a breach after receiving a data breach notification. It’s important to report the breach to the Information Commissioner’s Office (ICO) as soon as possible once you have been made aware of it — leaving no more than 72 hours. If you do not report the breach within this time frame, you will need to give reasons for your delay.

You may not be able to investigate and fully gather all the details in 72 hours. In this case, you can submit the information in phases, providing you make the initial report in that timeframe and offer a predicted date of submission for the subsequent details.

Exposed company data that ends up on the Dark Web leaves individuals open to identity theft and fraud. That is why businesses have a legal responsibility to protect the data of their clients and employees.

If they fail to take appropriate steps, they leave themselves vulnerable to steep regulatory fines in the event of a breach and failure to meet the breach-reporting requirements as stipulated by the General Data Protection Regulation (GDPR).

In addition to regulatory fines, data breaches are costly in terms of lost business caused both by staff having to remediate the effects of the breach and the reputational damage caused by the breach.

Furthermore, financial costs may result from litigation and possible compensation owing to those affected individuals.

All things considered, it’s not hard to see how a missed data breach could prove ruinous for a business.

If a business is made aware that sensitive company data has been exposed on the Dark Web, they can take immediate action to mitigate these risks.

SafeWeb Dark Web Monitoring tools perform enhanced searches of the Dark Web on a continuous basis, searching for company data that you have identified as sensitive. For example, we will look for specific data such as email addresses, personal records, domain records, credit card details, passwords and social account information and we will notify you via email if your business-sensitive data is found.

Once you receive your SafeWeb notification, you can take action to manage the risk before it becomes serious for you and your business. For example, if financial information has been breached, your business can advise those clients or employees affected to contact their financial institution.