Your Data Is on the Dark Web: What to Do Now

By NorwegianSpark Editorial · Published July 13, 2026 — written with AI assistance and reviewed by the NorwegianSpark SA editorial team.

If your information is on the dark web, do five things in this order: work out exactly what leaked; change any exposed password on every account where you used it; turn on two-factor authentication for email, banking and anything that matters; freeze your credit if an ID number or card leaked; and set up monitoring so you hear about the next leak early. You cannot delete the data itself — the goal is to make it useless.

First: it is a warning, not a break-in

If you have had a dark-web alert — from a monitoring service, your bank, or a free breach check — the first thing to know is that it is a warning, not a break-in. Your data being found on the dark web means a record linked to you is being traded; it does not mean an account has been taken over or that money has moved. That gap between exposure and harm is the window you act in, and this guide is the dark-web-specific playbook for using it. For the general first-hours checklist that applies after any breach, see what to do after a data breach — here we focus on what a dark-web exposure specifically changes.

Step 1: work out what leaked

Start by reading the alert for what was actually exposed, because a dark-web listing tells you more than a generic breach notice. If it is only an email address, the practical risk is more phishing and spam. If it is a password, assume it is already in a "combo list" being tried automatically across other sites — that is what makes a dark-web exposure more urgent than a company simply admitting a breach. If it is a card number, a national ID or identity documents, treat it as high-stakes and move to the credit and identity steps below. Triage first; the exposed data type sets everything that follows.

Step 2: change the exposed password everywhere

If a password was exposed, change that exact credential immediately — and change it everywhere you reused it, which is where the real damage happens. Because dark-web leaks feed automated credential-stuffing, the leaked pair is worth far more to an attacker across your other accounts than on the one that leaked. A password manager such as NordPass makes this feasible: it can generate a unique replacement, store it, and flag any other logins that shared the compromised password so you are not guessing which ones to fix. To test whether other passwords you still use have leaked, without sending them anywhere, use a k-anonymity checker such as our Breach Radar.

Step 3: lock down the accounts that matter

Turn on two-factor authentication — ideally an authenticator app or a passkey rather than SMS — so a stolen password alone cannot get in; our two-factor authentication guide walks through it. Start with your email account, because whoever controls your email can reset almost every other password.

Step 4: if an ID number or card leaked, protect your credit

If a card number leaked, call your bank to cancel or reissue it. If identity data leaked, the US Federal Trade Commission's IdentityTheft.gov (2026) recommends placing a free one-year fraud alert with one of the three credit bureaus, and considering a credit freeze, which blocks new accounts being opened in your name. The FTC states that a freeze "is free to place or lift", "doesn't affect your credit score", and that you "contact all three credit bureaus — Equifax, Experian, and TransUnion"; when you need credit later, you only lift it at the bureau your lender uses. Outside the United States, check what your own country's credit agencies offer. Watch your statements for anything you do not recognise. The full walkthrough is in our credit freeze guide.

Step 5: accept you cannot delete it, and monitor instead

Here is the hard truth this question is really asking about: you cannot remove your data from the dark web. Once information has been copied and resold across many parties, there is no central registry to delete it from and no one to compel. Services that promise to "erase your data from the dark web" are overpromising. What you can do is manage exposure going forward — enrol ongoing monitoring so you hear about the next leak early (we weigh whether it is worth it in what is dark web monitoring), and shrink how much of your information is available to be re-leaked by cutting down your data-broker footprint with a service like iolo RemoveMe. An all-in-one option such as Norton 360 with LifeLock bundles the monitoring, identity-restoration support and alerts in one place.

Watch for the follow-up scams

Leaked data is often used for targeted follow-ups rather than a direct break-in: extortion emails quoting an old password, calls asking you to read out a one-time code, and fake "we scanned the dark web for you" pop-ups. None of these needs a reply. The patterns are in dark web scams and threats.

The response is manageable if you take it in order: triage what leaked, rotate the exact credential everywhere, lock down with 2FA and — if identity data is involved — a credit freeze, then move to monitoring for next time. Our security tool comparison covers the services that do that monitoring. If you have not already confirmed the scope of the exposure, our guide to how to check if your data is on the dark web helps. And if you arrived here curious about what the dark web itself is, our sister site covers it in VPNTex on the dark web. This is general guidance, not legal or financial advice for your specific situation.

Continue in this collection

Best Security Tools

The shortlist across antivirus, VPN and password managers, and the reasoning.

Explore

Live Offers

What is actually discounted right now, rather than what once was.

Explore