Dark web monitoring for executives: what it can and cannot tell you

What dark web monitoring means for an executive

The dark web is the part of the internet that ordinary browsers cannot reach. The Consumer Federation of America's guide Dark Web Monitoring: What You Should Know describes it as reachable through a special browser such as Tor, with site addresses ending in ".onion". It has legitimate users, such as journalists and whistle-blowers, and it is also where people sell "stolen personal information and other illicit goods and services." Our glossary entry on the dark web has the short version.

Dark web monitoring for executives means looking for a leader's personal data in those markets and in the channels around them. The data in question is the kind that enables fraud against a person: Social Security numbers, card numbers, passwords and other personal information.

Executives' data has a price there. Rapid7's research Identity-as-a-Service: Uncovering Dark Web Marketplaces Trading Executive SSNs, published August 27, 2026, reports that its alert telemetry identified 476 instances of compromised SSN records across 395 unique corporate personnel since early 2026. C-suite executives made up 44.6% of the affected profiles and presidents another 28.6%. Of the three marketplaces the study examined, the cheapest charged a fixed $0.25 per SSN record; the others charged $1 and $4.

Breach data and a marketplace listing are different evidence

These two kinds of finding are easy to confuse. They answer different questions, and they lead to different actions.

Nisos's 2026 Executive Digital Exposure Trends findings show the gap. In the 72 executive vulnerability assessments Nisos analyzed, 64% of the executives had their SSN exposed in breach data, and 54% had it listed for sale on a dark web marketplace. The first number is a breach-data statistic. The second is a marketplace statistic. They overlap, but they are not the same measurement, and a buyer should know which one a vendor reports. The Nisos summary does not say how the 72 executives were chosen, so treat both numbers as one firm's sample.

The two also feed each other. Rapid7 describes marketplaces whose stock comes from large breaches, where "wholesale hackers compromise data aggregators, healthcare systems, and financial providers," and from infostealer malware and phishing, which supply fresher and more targeted profiles. Rapid7 writes that such mega-breaches account for the vast majority of the inventory available online. Our article on how stolen data is sold follows that path. Public bodies are in the same stock: our study of government credential leaks counted 642,639 of them across 192 countries, collected from 83 dark web and Telegram sources.

What it can tell you

A useful dark web finding about an executive answers four things:

• What is on offer. The data types in the listing, such as an SSN, a date of birth or a password.
• Where and when. The market or channel and the date of the post.
• How it is packaged. A single record, a bundle tied to a company, or part of a bulk dump.
• What to do first. The account, card or identity control that needs attention.

What it cannot tell you

Buyers often expect more than any service can deliver, as the survey below shows.

It cannot remove anything. The Consumer Federation of America is blunt: the people who trade stolen data "won't cooperate with an identity theft service or anyone else, so it's impossible to get the information removed, stop its sale, or prevent someone who buys it from using it." In a survey it commissioned, 36 percent of people who had seen dark web monitoring ads believed these services could remove their personal information, and 37 percent believed they could prevent its use. Neither is true.

It cannot see everything. A service reports what it collected. Data traded privately, or posted somewhere it does not collect from, will not appear.

It cannot vouch for the data. A listing shows that someone is selling records. It does not prove the records are current or accurate.

It cannot tell you intent. A for-sale SSN is a fraud risk to the person. It does not show who will buy it or whether your company is a target. Our page on who trades stolen company data covers the sellers.

What to do when a leader's data shows up

The response is the same whether the alert came from a vendor, a breach notice or an email from a stranger.

1. Treat unsolicited alerts with suspicion. The FTC's consumer alert Did you get an email saying your personal info is for sale on the dark web? warns: "Don't click a link or use a phone number in the message. It could be a 'phishing' email, designed to trick you into disclosing sensitive information to scammers."
2. Change passwords, starting with email. The same FTC alert advises changing passwords and starting with email accounts, because email resets everything else.
3. Freeze credit where it applies. For US persons, the FTC calls a credit freeze "the best way to protect against an identity thief opening new accounts in your name."
4. Verify sensitive requests out of band. Rapid7 recommends mandatory secondary confirmation for financial transactions, access requests and administrative changes involving executive accounts, "to reduce the risk of successful impersonation."
5. Brief the assistant and the family. Personal data about a leader is often used against the people around them. The first-day checklist for doxxing executives covers that side.

Where CEM and EDG3 fit

WebThreat has three offerings that touch this problem, and they work on different data.

CEM starts from a company name, finds the leadership team and checks each person against breach corpora and leak databases. It shows which of a leader's records are exposed, for example emails, phone numbers, passwords and SSNs, and ranks the findings by what to fix first (see the methodology). Credentials in those corpora were leaked in breaches, and many were traded on the dark web. CEM matches them to your leaders, with first findings within minutes and nothing installed.

EDG3 watches dark web forums and marketplaces, Telegram and other channels, and leak databases. For an authorized domain it traces each listing to its first post and the seller behind it, and tells a new listing from a repost.

Information removal covers listings on people-search sites: our specialists file the opt-outs and takedown requests for a leader's personal information and verify each removal.

The three work on separate data. For the credential side of the same question, read credential leak monitoring: what it can and cannot tell you.

Questions to ask a vendor

• Do you report breach-data matches, marketplace listings, or both, and how do you label which is which?
• Which markets and channels do you collect from, and which are out of reach?
• Do you show the listing, the date and the price, or only a flag?
• Can you tell a new listing from a repost of an old breach?
• What do you expect the customer to do with a finding?

A vendor that labels "this leaked" separately from "this is for sale" gives you evidence you can act on.