Is Your Data on the Dark Web? How to Check

So about your data being on the dark web

Most people put off checking whether their personal data is floating around on the dark web. For almost anyone who has been online for a decade, it is. A typical check turns up several breaches, often from Indian services you barely remember signing up for, with your email, phone number and an old hashed password sitting in a leaked database anyone with a Tor browser can download.

I won't be showing you how to browse sketchy marketplaces. This post covers how your data ends up there in the first place, how to check whether you've been hit, and what you can realistically do about it. There's India-specific stuff too, because Aadhaar numbers and phone numbers carry far more risk here than most people realise. If you want the basics you should already have in place, our cybersecurity tips guide covers them.

If you've used the same email address for more than a few years and signed up for random services with it, some of your info is almost certainly out there. How bad is it? That's the useful question.

What the dark web is (and isn't)

Forget the hoodies. The dark web is a set of websites that Google and Bing don't index, and you can only reach them with special software like the Tor browser.

The internet has three layers. The surface web is what you use every day: Google, YouTube, Wikipedia, your bank's website. It's estimated to be less than 5% of all content online. The deep web is everything behind logins and paywalls, like your email inbox, medical records on a hospital portal, subscription-only databases and company intranets, none of it sinister, just not publicly searchable. The dark web is a small part of the deep web that needs specific software to access, and where operators can host sites anonymously.

It has legitimate uses. Journalists in repressive countries use it, whistleblowers need it, and privacy researchers rely on it. It's also where stolen data gets bought, sold and traded, and that's the part that affects you.

Most people don't realise how much dark web marketplaces resemble regular e-commerce. Sellers have ratings and reviews, there's customer support, and some vendors offer "freshness guarantees" on stolen credit card data, meaning they'll replace a card that's already been cancelled. Disturbingly professional.

How your info gets there

There are a few main pipelines. Knowing them helps you work out your own risk.

Data breaches are the big one. A company gets hacked, its user database is stolen, and it ends up for sale or dumped on dark web forums for free, and Indian users have been hit hard over the past few years. BigBasket leaked 20 million records in 2020. MobiKwik exposed 3.5 million KYC records in 2021, including Aadhaar numbers, PAN cards and selfies. Air India lost 4.5 million passenger records with passport and credit card info. Dominos India leaked 180 million order details: names, phone numbers, addresses, even what pizza you ordered. JustDial leaked phone numbers and emails more than once.

If you used any of these services, your data was exposed. No maybes about it.

Breaches also often stay quiet for months or years. A company gets hacked in January, the data shows up on a dark web forum in March, and the company finally admits it in September, if it admits it at all, while during those silent months your data is being bought, combined with data from other breaches, and used to build fuller profiles.

Phishing and social engineering is the second biggest pipeline. Remember those fake "KYC verification" SMS messages that look like they're from your bank? Whatever people type into those fake sites gets bundled and sold in bulk on dark web marketplaces. I've talked to security researchers who found databases with thousands of Indian bank credentials collected from a single phishing campaign that ran for just two weeks.

Infostealer malware runs silently on infected devices and grabs saved passwords, browser cookies, crypto wallets and session tokens. It all gets packaged into "logs" and sold in bulk, and one infected laptop can give up dozens of account credentials without its owner ever knowing. Infostealers are especially common in pirated software, so that cracked Photoshop or "free" Windows activation tool could be uploading everything you type to a server in Eastern Europe.

Then there's data scraping, where bots vacuum up publicly visible info from social media profiles, government directories and business listings. And there are insider threats, which are more common than people think, especially in organisations with poor access controls (call center employees sitting on customer databases, for example). I know someone who works in cybersecurity consulting, and he told me that in the financial services sector alone, they've caught insiders selling customer data at least twice a year for the past five years.

What your data sells for

Rough prices:

Per record the prices look low. The money is in volume: a breach with 10 million email/password combos sold at Rs 80 each brings in Rs 80 crore, and the same data gets sold several times to different buyers.

Medical records surprise a lot of people. Think about what's in them, though: your full name, date of birth, address, phone number, insurance details, and usually your Aadhaar number too, which is most of what an identity thief needs. You can get a new credit card in 48 hours. You can't get a new medical history.

Data also doesn't get sold once and vanish. A stolen database might change hands five or six times in a year, and each buyer uses it differently. One tries credential stuffing on other sites, another runs targeted phishing, a third combines it with other breaches to build more complete profiles. So one leaked email and password from some random food delivery app can become the way into your banking, social media or work accounts if you reused that password anywhere.

How to check if you've been exposed

Have I Been Pwned (haveibeenpwned.com)

Start here. It's run by Troy Hunt, a security researcher, and if you type in your email address it tells you which data breaches included your info.

Check every email address you've ever used, and your phone number too (with the country code, +91 for India). Sign up for the free notification service so they email you whenever your address turns up in a new breach. Each notification gives you a head start on changing passwords before things get worse.

Most people skip their old email addresses. Don't. That Rediffmail or Yahoo account you made in college and haven't touched in a decade has probably been breached, and if it shared a password with anything else, those credentials are out there. Old addresses are especially risky because you may not be able to log in to secure them anymore, while attackers can still try.

Google Dark Web Report (retired)

This used to be one of the better free options. It scanned dark web forums and marketplaces instead of relying only on known public breaches, and it looked for combinations of your name, phone number and address as well as your email. Google shut it down in early 2026: scans stopped on January 15 and the report and its data were deleted on February 16. Google now points people to Security Checkup, Password Checkup and "Results about you" instead, which cover some of the same ground.

Mozilla Monitor (monitor.mozilla.org)

Formerly Firefox Monitor. It's built on Have I Been Pwned's database with a cleaner interface, and if you use Firefox it's handy because it ties into your Mozilla account.

Your browser's password checker

Chrome (passwords.google.com) and Safari both have built-in checks that compare your saved passwords against known breach databases, and so do password managers like Bitwarden and 1Password. Open yours now. Change anything that's flagged, starting with financial accounts.

The first time you run Chrome's password check, don't be surprised if it flags dozens of compromised passwords. Most will be for forgotten accounts, but a few may still be active, including ones that share a password with your primary email.

Credit report monitoring

In India, get your credit report from CIBIL (cibil.com), Experian, Equifax or CRIF High Mark. You're entitled to one free report per year from each bureau. Look for credit inquiries you didn't start, accounts you don't recognise, address changes you didn't make, or sudden score drops that make no sense.

Spread those free reports across the year (CIBIL in January, Experian in April, Equifax in July and CRIF in October) and you get quarterly coverage without paying for it.

What to do after finding a breach

Don't panic. Do move fast, in roughly this order.

First 15 minutes: change compromised passwords. Start with the breached account, then change the password on every other account where you used the same one. Yes, I know you shouldn't be reusing passwords; we'll fix that in the long-term steps.

Next 30 minutes: turn on two-factor authentication. Start with email, since password resets land there and it opens everything else. Then do banking and financial apps (UPI, Paytm, PhonePe, Zerodha), social media and cloud storage. Use an authenticator app like Google Authenticator, Authy or Microsoft Authenticator instead of SMS, because SIM swap attacks are far too common in India for SMS-based 2FA to be reliable.

Next hour: check for unauthorized access. Review recent login activity on your Google account (myaccount.google.com → Security → Recent security activity), then check connected apps and revoke anything unfamiliar. Look through your email's sent folder for messages you didn't write, and check your UPI transaction history. Then open the "recent sessions" or "logged in devices" list on every account that has one: Facebook, Instagram, Twitter, Amazon, Flipkart. End any session on a device you don't recognise straight away.

If financial data was exposed, call your bank's fraud helpline immediately and ask for a new card or account number. Turn on alerts for every transaction and file a written complaint with the bank's grievance cell. If you spot unauthorized transactions, note the exact amounts, dates and merchant names, and don't delete or change any evidence.

File an official complaint. In India that means cybercrime.gov.in (National Cyber Crime Reporting Portal) or a call to 1930 (Cyber Crime Helpline, toll-free). Your local police station can also file an FIR under the IT Act. Save everything (screenshots, emails, transaction records), because you'll need it if you dispute fraudulent charges later.

Long-term protection that works

Unique passwords for every single account

This one can't be overstated: with a reused password, one breach spreads to everything. Get a password manager. Bitwarden is free and open-source, 1Password is good, and even the built-in browser one is fine if that's what you'll stick with. What matters is generating random passwords for everything and letting the manager remember them. My Bitwarden vault has 340+ passwords in it. I couldn't remember even 10.

Good master password examples:
- "mango-bicycle-umbrella-keyboard-77" (passphrase style)
- "Mumbai$Train$at$7:45AM" (sentence style)

Bad master passwords:
- "Password123" (obvious)
- "anurag1990" (personal information)
- "qwerty!@#" (keyboard pattern)

The switch takes time, and that's okay, because you don't need to update all 340 passwords in one sitting. Do the critical ones first (email, banking, anything financial), then change the rest over a few weeks whenever you happen to log in to a service, and in a month or two you'll have covered everything.

Email aliases

Services like SimpleLogin, addy.io (formerly AnonAddy) or Apple's Hide My Email generate a unique email address for every service you sign up for. If one service gets breached, only that alias is exposed; your real email stays clean, and you can simply disable the leaked alias.

Example setup:
- Real email: anurag@gmail.com (used for nothing except critical personal contacts)
- Amazon: amazon.1x7k@simplelogin.co
- Zomato: zomato.8m2n@simplelogin.co
- Netflix: netflix.4j9p@simplelogin.co

When something leaks, the alias tells you which service was the source. If an alias you gave one service starts getting spam from companies you've never heard of, you know exactly who sold your data.

Credit monitoring

Set up free credit monitoring through CIBIL, which offers email alerts for credit inquiries, so you'll know if someone tries to open an account in your name. India doesn't have a formal credit freeze like some other countries, but you can put a fraud alert on your CIBIL profile, opt out of pre-approved credit offers, and ask your bank to add extra verification for new accounts.

Device security basics

This stuff sounds obvious. I keep meeting people who skip it anyway. Keep your phone and laptop operating systems updated, since those updates patch known exploits. Don't install apps from outside the official stores unless you really know what you're doing. Be careful with browser extensions, because some can see every page you visit, banking sites included. Every few months, go through your extensions and remove whatever you don't use. And please don't do banking on public WiFi, or if you absolutely have to, use a VPN.

The Aadhaar and phone number problem

This is where things get tricky for Indians specifically.

Aadhaar numbers are especially dangerous because they're linked to biometric data and used for identity verification in banking, SIM cards and government services. A credit card can be replaced. An Aadhaar number can't.

If yours has leaked, do this:

1. Lock your biometrics through myaadhaar.uidai.gov.in or the mAadhaar app. Nobody can use biometric authentication against your Aadhaar until you unlock it.
2. Generate a Virtual ID (VID). It's a temporary 16-digit number linked to your Aadhaar that you can give out instead of the real number. Generate a new one every few months.
3. Check your authentication history on the UIDAI portal. It lists every time your Aadhaar was used, so look for anything you didn't authorize.
4. Stop sharing your Aadhaar when you don't have to. Your gym doesn't need it, and neither do random shops. The VID works for legitimate purposes. Hotel wants Aadhaar at check-in? Give the VID. Startup wants it as "identity proof" during onboarding? Push back and ask whether they'll take a VID or another document.

Check your Aadhaar authentication history for attempts you don't recognise, such as a mobile carrier you've never used, which can mean someone is trying to get a SIM card in your name. With your biometrics locked, those attempts fail. Without the lock, a fraudster could get the SIM, intercept your OTPs and get into your bank accounts.

Phone numbers in India work like identity documents now. They're tied to bank accounts through UPI, to Aadhaar, to social media and to email recovery, so a compromised number opens the door to SIM swap attacks.

To protect yourself, set a SIM lock PIN with your telecom provider (Jio, Airtel and Vi all support this), keep your number off public social media profiles, consider a separate number for financial accounts, and be very suspicious of any call from someone claiming to work for a telecom company.

UPI fraud is still the most common financial cybercrime in India. The scams are nearly always a variation on three things: fake "collect" requests dressed up as refunds (you never need to enter your PIN to receive money), screen sharing apps that let someone watch you type your PIN, and fake customer service numbers that show up in Google search results.

Building a security routine

You can't set this up once and forget it. It's a habit, like brushing your teeth. Boring, necessary.

My monthly routine takes maybe 30 minutes:

• Check Have I Been Pwned for new breaches
• Review your Google or Apple account security activity
• Look at your CIBIL credit report for anything weird (quarterly is fine)
• Go through your phone and remove app permissions you don't need anymore
• Update any flagged passwords in your password manager
• Check your Aadhaar authentication history
• Glance through bank and UPI transaction history for anything unfamiliar
• Install pending software updates on your phone and laptop
• Clear browser cookies and review saved passwords

Once a year, do the bigger jobs: rotate your most important passwords, close accounts you don't use anymore (JustDelete.me has instructions for most services), generate a new Aadhaar VID, and back up your password manager vault.

I've been doing this for about two years, and it gets quicker every month because there's less to clean up. The first month was rough, with a couple of hours spent just going through old accounts and updating passwords. These days it's 20-30 minutes, usually with something on TV. Scheduling is what makes it stick. I do mine on the first Sunday of every month. Put it in your calendar, or it won't happen.

Tools worth having

Free

Paid (but worth considering)

A solid low-cost setup is Bitwarden (free) for passwords, SimpleLogin (paid) for email aliases, and CIBIL's free annual report. That comes to roughly Rs 250 a month, since SimpleLogin is the only paid piece (on the annual plan; monthly billing costs a bit more), which is reasonable insurance against the nightmare of identity theft. If you want privacy-respecting replacements for mainstream apps as well, see our guide to privacy-focused apps and alternatives.

If someone's already using your identity

If you find unauthorized accounts, loans or fraud in your name:

1. File an FIR at your local police station with all the evidence: unauthorized transactions, breach notifications, account statements.
2. Report it as cybercrime at cybercrime.gov.in or on the 1930 helpline. CERT-In (cert-in.org.in) handles security incidents affecting organisations and systems, so it isn't the place for an individual identity theft complaint.
3. Report to RBI if banking fraud is involved. The Banking Ombudsman can investigate unauthorized transactions.
4. Dispute with credit bureaus. File a dispute with CIBIL, Experian and Equifax to flag the fraudulent accounts.
5. Talk to a lawyer if the financial damage is significant.

Fair warning: this process is slow and frustrating. India's cybercrime infrastructure is improving but still underfunded. Document everything and keep following up.

Something I learned helping friends through this: from day one, keep a dedicated folder (physical or digital) for every fraud-related document. Keep copies of every FIR, every bank complaint acknowledgment and every email exchange. You will have to follow up, several times, and having it all organised and numbered makes a big difference, because bureaucracies respond better to people who are organised and persistent.

If someone took a loan in your name, write directly to the NBFC's or bank's nodal officer instead of stopping at the customer service line. Under RBI guidelines they have to respond within a specific timeframe, and if they don't, escalate to the Banking Ombudsman with proof that you contacted them and they didn't act.

What you can and can't control

Accept early that perfect privacy is impossible if you use the internet. Hundreds of companies have already collected your data, and some of them will get breached. The Digital Personal Data Protection Act (DPDPA) has made some progress, but enforcement is still catching up.

What you can control is how much damage one incident does. Unique passwords stop one breach from spreading, and email aliases keep your real address clean. With 2FA, a stolen password alone isn't enough. The Aadhaar biometric lock makes your identity hard to misuse even if the number leaks, and credit monitoring helps you catch fraud early. To lock down your home network as well, our home network security guide covers every step.

Password managers and email aliases are dull. Untangling identity fraud is far worse: recovery can take months of phone calls, police station visits and sometimes a lawyer, often because someone used a leaked PAN and Aadhaar to open a credit card the victim didn't know about until the collection calls started.

So take 30 minutes today. Check Have I Been Pwned, set up a password manager and lock your Aadhaar biometrics.