The message usually arrives on an ordinary afternoon, from your password manager, your bank, Have I Been Pwned or a paid monitoring service: your information has been found on the dark web. It rarely says much more than that, and most people react in one of two ways. Some panic and change every password they own, others shrug and close the tab because there is nothing obvious to do.
Neither reaction is quite right. A dark web alert is a piece of information about one specific leak, and what you should do depends almost entirely on which piece of your data turned up. A leaked email address and a leaked Social Security number are very different problems, so the first job is to work out which one you are dealing with.
First, Find Out What Leaked and When
Open the alert and look for two things: the type of data and, if it is given, the breach it came from. Many alerts concern leaks that are several years old, from a forum or an online store you may have forgotten, and the data in them has often been resold many times. That does not make them harmless, but it changes the urgency. A password from a 2019 breach that you changed long ago is a footnote, while a password you still use everywhere is an emergency.
If the alert does not name the source, search for your email address on Have I Been Pwned, which lists the known breaches it appeared in, with dates. That usually tells you enough to decide what to do next.
If It Was a Password
This is the most common alert and the one to handle first, because leaked passwords are tested automatically on other sites within days. Change the password on the account in question, then on every other account where you used the same one, starting with your email, since whoever controls your inbox can reset everything else. While you are there, turn on two-factor authentication with an authenticator app, so that a stolen password alone is no longer enough to log in. Most services also let you sign out every other session, which is worth doing if you have any doubt.
If you reuse passwords, this alert is the moment to stop. A password manager makes it painless, and it means the next leak only affects one account.
If It Was Your Email Address or Phone Number
An email address on its own does not let anyone steal your identity, but it does tell scammers that you exist and which services you use, and leaked lists are what targeted phishing campaigns are built from. Expect more convincing fake messages for a while, especially ones that mention the company that was breached, and treat any message asking you to log in or confirm details with suspicion, even if it looks legitimate.
A leaked phone number brings spam calls and texts, and one more serious risk: a fraudster can try to move your number to a new SIM card and receive the security codes meant for you. A quick call to your carrier to set up a port-out PIN or a number lock closes that door.
If It Was a Card Number or Bank Details
Call your bank or card issuer, tell them the number appeared in a leak, and ask for a new card. Most banks do this without argument. Then go through your recent statements for charges you do not recognize, including very small ones, which are often used to test whether a stolen card works. Turning on transaction alerts in your banking app means you will hear about the next purchase the moment it happens.
If It Was Your Social Security Number
This is the alert that deserves real attention, because a Social Security number, combined with your name and date of birth, is what someone needs to open credit in your name. Freeze your credit with Equifax, Experian and TransUnion, which is free and blocks new accounts until you lift it. Request an Identity Protection PIN from the IRS so that nobody can file a tax return in your name, and download your credit reports to check that nothing has been opened already.
From then on, the number stays exposed for good, since you cannot change it the way you change a password. That is why this particular alert is the one that most often pushes people toward a paid identity theft protection service, and our explainer on what these services do and who needs them can help you decide whether you are one of those people.
Where Free Alerts Stop
Free tools are good at telling you that something leaked, and that is roughly where they stop. They do not watch your credit file, they do not notice a payday loan taken out in your name, and they do nothing once fraud has actually happened.
Paid services cover that ground, and Coveron, the identity protection service from Nord Security, the company behind NordVPN, shows what the difference looks like in practice. Its dark web monitoring watches your email addresses, phone numbers, card numbers and Social Security number, and each alert names both the source and the type of data, which is exactly the information you need to decide which of the steps above applies. Its higher plans add credit monitoring, alerts for short-term loans and new bank accounts opened in your name, and a credit lock you can use from the dashboard when an alert looks serious.
If an alert does turn into identity theft, Coveron assigns a case manager to handle the recovery and its insurance, underwritten by HSB, covers up to $2 million in recovery costs, which is the part no free tool comes close to. It is sold only in the US, and New York residents cannot claim the insurance. Our Coveron review goes through the plans and our guide to the best identity theft protection services compares it with four alternatives.
Get Dark Web Alerts With Coveron
Making the Next Alert Less Likely
You cannot stop companies from being breached, but you can make each leak contain less. Give stores a secondary email address, leave optional fields empty, delete accounts you no longer use, and keep your date of birth and phone number off public profiles. Data brokers are the other source to deal with, since they sell the details that turn a leaked email into a full profile, and a service like Incogni, from the same group as Coveron, asks them to delete what they hold. Our guide to removing your personal information from the internet explains how to do it yourself.
