Dark web

How it works

• Reached with special software and not listed in search engines.
• Data from breaches of other companies is sold there in bulk, including staff email addresses and passwords.
• Buyers use them for takeovers, fraud and credential stuffing.
• You usually learn you are listed only if someone is watching for it.

What can go wrong (example scenario)

A three-person travel agency's owner had used the same password on a hotel booking site that was breached years earlier. Nobody told her. Much later someone used it to log into her Microsoft 365 account and read client passport scans.

How WILDCARD handles it

Identity Monitor exists because your domain, your team's identities and your business data could already be exposed on the dark web without your knowing. It watches every login and session around the clock and shuts down suspicious activity automatically. Password Manager helps with the reused passwords that make leaks dangerous.

• A dental office learns that a staff email and password appeared in a breach of a dental supply site.
• A law firm wants to know within hours if a partner's credentials appear anywhere.
• A retailer finds its Shopify admin login in a dump and resets it before anyone tries it.

Example scenario: A small non-profit received an alert that the treasurer's email and an old password had shown up in a fresh dump. He had used that password on the bank portal until the week before. The remaining accounts using it were changed that afternoon, and MFA went on everywhere.

A question owners ask

Can you remove my data from the dark web?

No one can. What you can do is make the leaked password worthless by changing it and adding MFA, which is exactly what the alert is for.