Understanding how stolen credentials reach criminal markets explains why dark web monitoring is a necessary control – even for organisations that have never experienced a direct breach of their own systems.

Third-party breaches are the primary source. When a SaaS platform, supplier, partner, or any website your staff have registered with using work email addresses is breached, the stolen credential database is packaged and sold on criminal marketplaces. Your staff never knew the breach happened. Your systems were never touched. But your work email address and the password your staff member reused across multiple accounts is now on a forum read by thousands of criminal actors.

Stealer malware collects credentials from infected devices. Infostealer malware – distributed via phishing emails, malicious downloads, and compromised software – silently harvests saved passwords from browsers, credential managers, and active sessions on infected devices. Harvested credential packages (called "stealer logs" or "logs") are sold in bulk on dark web markets. A single infected personal laptop belonging to a staff member who uses it to access work systems is enough to expose every credential they have ever saved in their browser.

Credential stuffing lists aggregate exposures over years. Criminal actors compile credential stuffing lists – massive files containing billions of email/password combinations harvested from every major breach over the past decade. These lists are continuously updated, traded, and used in automated credential stuffing attacks against every major business login portal. If your domain appears in any historical breach, your credentials are probably in a stuffing list already being used against your login pages.

Data brokers compile and sell identity packages. Beyond passwords, the dark web trades full identity packages: name, email, physical address, date of birth, TFN (where available), and professional information – assembled from multiple breach sources. These packages are used for identity fraud, targeted spear phishing, and social engineering attacks that reference accurate personal details to build credibility.

For the full picture of how modern cyberattacks exploit exposed credentials across multiple stages, read our guide: How Staged Cyber Attacks Work.

Data Sources Monitored

Code Hyper One's dark web monitoring covers the full range of sources where Australian business credentials and sensitive data appear – not just the visible tip of the iceberg.

Criminal Marketplaces Dark web markets where stolen credentials, credit card data, and identity packages are bought and sold at scale. These markets operate with product listings, reviews, and transaction guarantees – a sophisticated criminal economy targeting Australian businesses among global victims.

Hacker and Cybercriminal Forums Underground forums where breach databases are shared, traded, or dumped publicly – often as a demonstration of capability or as a precursor to monetisation. Forum-distributed credentials are frequently available to low-sophistication actors who could not otherwise purchase them.

Paste Sites and Data Dumps Public and semi-public paste sites (Pastebin, Riseup, Ghostbin, and their dark web equivalents) where breach data is published for free access – common immediately following major breaches as attackers demonstrate scale.

Stealer Log Repositories Dedicated repositories of infostealer malware output – credential packages harvested from infected devices, containing browser-saved passwords, session tokens, and auto-fill data. Stealer logs are one of the fastest-growing dark web data categories and are increasingly used to bypass multi-factor authentication via session hijacking.

Telegram-Based Trading Channels Criminal trading has increasingly migrated to Telegram channels, where breached data, credential packages, and access credentials are traded in near-real time. Telegram monitoring is essential for current coverage – many recent Australian business credential exposures first appeared in Telegram before migrating to traditional dark web markets.

Breach Intelligence Databases Aggregated repositories of known breach data from hundreds of thousands of historical incidents – continuously updated as new breaches are added and correlated against previously known data. This is the layer that catches historical exposures that are being re-circulated years after the original breach.

IRC Channels and Closed Criminal Communities Invitation-only criminal communities operating through encrypted IRC channels and private forums, where more sophisticated actors trade higher-value access credentials and targeted attack intelligence.

Our monitoring does not only look for email/password pairs. We monitor for the full range of sensitive data types that constitute a meaningful business exposure:

Email Credentials Every staff email address tied to your domain – @yourdomain.com.au – paired with any associated password from any breach source. This is the most common and most immediately dangerous finding, as compromised email accounts provide access to business communications, internal documents, and linked SaaS applications.

Domain Credentials and Administrator Accounts Privileged account credentials (IT administrator accounts, Microsoft 365 global admin accounts, VPN credentials, server access credentials) that provide elevated access to your environment.

API Keys and Service Tokens API keys, OAuth tokens, and service account credentials exposed in code repositories, SaaS breaches, or developer forum posts – credentials that provide programmatic access to cloud services, development environments, and business applications.

Personal Information of Staff Names, physical addresses, personal email addresses, phone numbers, and date of birth data for staff members – used in identity fraud, targeted spear phishing, and social engineering attacks that reference accurate personal details to establish credibility.

Financial Account Information Corporate credit card numbers, bank account details, and financial system credentials where associated with your domain or known staff identifiers.

Intellectual Property and Business Data Business documents, client lists, contracts, and confidential information appearing in file-sharing or paste site dumps following a breach or insider incident.

Session Tokens and Authentication Cookies Harvested session data from stealer malware – particularly valuable for attackers because active session tokens can bypass multi-factor authentication entirely, making them more immediately dangerous than plain password exposures.

This is the section GMAN IT does not have – and the section that makes the difference between dark web monitoring that protects your business and dark web monitoring that produces a notification and nothing else.

Step 1 – Alert Delivery and Context You receive an alert containing: the exposed credential (partially masked for security), the source where it was found (marketplace name, forum, paste site, or breach database), the estimated date of exposure, the credential type (password, token, API key), and an initial assessment of whether the exposed credential appears to still be in active use against your systems.

Step 2 – Immediate Credential Assessment Code Hyper One's security team assesses the finding: Is the credential still active? Is the password still in use or has it already been changed? Has any suspicious login activity been observed on the associated account since the credential's estimated exposure date? Is the credential associated with a privileged account requiring elevated response priority?

Step 3 – Forced Credential Reset The affected account undergoes immediate forced password reset through Microsoft Entra ID – invalidating any active sessions associated with the compromised credential and requiring the staff member to set a new password on next login. Where the exposed credential matches a legacy password no longer in use, we verify and document this before closing the finding.

Step 4 – MFA Verification and Enforcement We verify that multi-factor authentication is correctly configured and enforced on the affected account. If MFA was not previously enforced, the finding provides the trigger for MFA enforcement on that account and an audit of the organisation's broader MFA coverage. An exposed credential with MFA enforced is a significantly reduced risk – an attacker who has the password cannot authenticate without the second factor.

Step 5 – Session Token Invalidation (Stealer Log Findings) Where the finding involves a harvested session token (stealer log output) rather than a plain password, we initiate session invalidation across all active sessions for the affected account – because a session token can authenticate an attacker even after a password change, making token revocation the critical response action.

Step 6 – Audit of Connected Access The compromised credential account is reviewed for: recent login history (identifying any suspicious access that may have already occurred), email forwarding rules (a common attacker persistence mechanism), OAuth application consents (applications granted access that may allow continued access after a password change), and any administrative actions taken if the account has elevated privileges.

Step 7 – Scope Assessment and Related Account Review If one staff member's credential is exposed, we assess whether other accounts sharing similar password patterns may be at risk. Password reuse and pattern-based passwords (Company2024!) often mean a single exposed credential provides a template for attacking adjacent accounts.

Step 8 – Documentation and Incident Record Every dark web finding and its response is documented – source, exposed data type, detection date, response actions, and outcome. This documentation serves both your internal security records and your compliance obligations under the Privacy Act Notifiable Data Breaches scheme, where a credential exposure that results in a Privacy Act breach requires documented evidence of the organisation's response.

For Code Hyper One's Microsoft 365 managed clients, dark web monitoring alert response is integrated directly with your Microsoft 365 environment – meaning the path from "credential found on dark web" to "account secured" is direct, fast, and documented.

Entra ID Password Reset and Session Revocation A dark web match triggers an immediate Entra ID password reset and sign-in session revocation – all active sessions for the affected user are terminated simultaneously, including sessions on mobile devices and browser sessions that may be in active use.

Conditional Access Policy Review Following a credential exposure, we audit the affected account's conditional access policy to ensure: compliant device requirements are enforced, geographic access restrictions are appropriate, and any legacy authentication protocols that bypass MFA (SMTP AUTH, POP3, IMAP) are disabled for the account.

Microsoft Defender for Identity Alert Correlation Where Microsoft Defender for Identity is deployed, dark web findings are correlated against identity-layer alerts in our managed SOC – checking whether the exposed credential shows signs of active exploitation in your environment that may have occurred before the dark web alert was generated.

Microsoft 365 Audit Log Review Following a credential exposure, Exchange Online and Microsoft 365 audit logs are reviewed for the affected account's activity history – identifying any suspicious actions (mass email downloads, external sharing, forwarding rule creation) that may indicate the credential was already in use before the dark web alert.

See our Microsoft Entra ID services and Microsoft Defender management for the full Microsoft 365 security management context this integrates with.

Dark web monitoring does not operate in isolation. It is one component of a defence-in-depth security model – and it is most powerful when connected to the security controls it informs and supports.

Dark Web Monitoring → Human Risk Management When a staff member's credential is found on the dark web, they receive targeted training through our Human Risk Management programme – specifically covering password security, credential reuse risks, and the attack types that exploit exposed credentials. A technical response without a behavioural response leaves the human factor unaddressed.

Dark Web Monitoring → Email Security Exposed credentials are often used to compromise email accounts and send internal phishing emails from trusted, legitimate addresses. A dark web finding triggers heightened monitoring of the affected account's outbound email behaviour through our email security service.

Dark Web Monitoring → SOC/MDR Dark web findings are fed into our managed SOC as threat intelligence – correlating exposed credential alerts with identity and endpoint telemetry to identify whether exploitation is already underway. A credential found on the dark web today may have been used to access your systems weeks ago – and the SOC investigation looks back through historical telemetry to determine this.

Dark Web Monitoring → Vulnerability Scanning An exposed service account credential may provide access to a specific system. Vulnerability scanning of that system's authentication surface is prioritised following a credential exposure finding affecting service or administrative accounts.

Dark Web Monitoring → Penetration Testing Credential exposure findings inform the scope of penetration testing engagements – specifically, social engineering scenarios and credential stuffing tests are directed at the email domains and account types showing the highest dark web exposure frequency.

Not all credential exposures carry the same business risk. The value of what an attacker can access with your credentials – and the regulatory consequences of a resulting breach – varies significantly by industry.

Legal and Professional Services Legal firms manage confidential client information, litigation strategy, settlement negotiations, and financial transactions – all of which are high-value targets. A compromised email account at a law firm provides access to privileged communications that can be used for insider trading, litigation strategy theft, and client fund fraud. The Privacy Act consequences of a legal firm breach are severe.

Healthcare and Allied Health Healthcare credentials provide access to patient records protected by the Privacy Act and the My Health Records Act. A breach of a patient-management system resulting from a compromised credential is a reportable incident under the Notifiable Data Breaches scheme – with mandatory notification to the OAIC and potentially to affected patients.

Financial Services and Accounting Accounting and financial services credentials provide access to client financial data, tax records, and payment processing systems – high-value targets for BEC attacks, client fund fraud, and data theft. APRA-regulated entities face specific reporting obligations under CPS 234 for material credential breaches.

Construction and Engineering Project files, tender documents, and contractual information are valuable intelligence for competitors. Compromised project management credentials can expose upcoming project details, pricing strategies, and client relationships.

Retail and E-Commerce Customer PII and payment processing credentials are primary targets. A credential compromise resulting in customer data access creates significant Privacy Act exposure and reputational risk.

For context on the current Australian cyber threat landscape facing SMBs across these industries, read: 2025 Cyber Threat Landscape for Australian SMBs.

Privacy Act 1988 – Notifiable Data Breaches Scheme

The Notifiable Data Breaches (NDB) scheme requires Australian organisations with annual turnover above $3 million (and certain other categories) to notify the OAIC and affected individuals when a data breach involving personal information is "likely to result in serious harm." A dark web credential exposure that results in unauthorised access to systems containing personal information – even if that access predates the dark web alert – may trigger NDB notification obligations.

Dark web monitoring enables organisations to: detect credential exposures before they are exploited (preventing the breach from occurring), or detect evidence of exploitation early (minimising the harm and supporting timely notification). Our response documentation provides the incident timeline evidence required for NDB compliance assessment. For broader guidance on responding to a data breach, read our guide: Data Breach Response for Australian Businesses.

ASD Essential Eight

The Essential Eight does not prescribe dark web monitoring as a specific control – but credential exposure directly undermines the effectiveness of multiple Essential Eight controls, particularly Multi-Factor Authentication (ML2+) and Restrict Administrative Privileges (ML1+). A discovered credential exposure is the trigger for the remediation actions (forced reset, MFA enforcement, privilege review) that maintain Essential Eight compliance in practice. See our Essential Eight Checklist 2026.

APRA CPS 234

For APRA-regulated financial services entities, information security controls must be commensurate with threats. Credential-based attacks are a documented primary threat to financial services entities in Australia, and dark web monitoring represents a proportionate, specific control against this threat vector. Our response documentation satisfies APRA's requirements for documented incident identification and response procedures.

Cyber Insurance

Australian cyber insurers increasingly include credential monitoring evidence in their underwriting questionnaires. Some policies specifically ask whether the organisation monitors for exposed credentials and how quickly they respond to credential exposure findings. Code Hyper One's same-day alert and documented response workflow satisfy standard insurer evidence requirements. For the full picture of what cyber insurers require in 2026, read: Cyber Insurance Requirements for Australian Businesses.

It is not a scan of the public internet. Dark web monitoring specifically covers areas of the internet that are not indexed by standard search engines – hidden services, criminal forums, and closed trading platforms. It is not a Google Alert for your domain name.

It is not a one-time check. Point-in-time dark web scans (many free "dark web scan" tools) check your email address against a static database of historical breaches. Continuous dark web monitoring watches for new exposures as they happen. The difference is the same as the difference between a single medical check-up and ongoing health monitoring.

It does not prevent the breach that exposed your credentials. Dark web monitoring cannot prevent a third-party SaaS vendor from being breached. It closes the window between a breach occurring elsewhere and your credentials being used against you – it does not eliminate the upstream risk.

It is not a replacement for MFA. Dark web monitoring and multi-factor authentication are complementary controls. MFA reduces the damage when credentials are exposed – an attacker who has your password still cannot authenticate without the second factor. Dark web monitoring catches the exposure so you can force a password reset and verify MFA is in place. Both are required.

It does not monitor social media or the surface web. Dark web monitoring focuses on criminal trading infrastructure – the specific platforms where stolen credentials and sensitive data are monetised. It does not monitor your company's public reputation, news coverage, or social media mentions (which are separate brand monitoring services).

Real-Time Alert Notifications Same-day email and phone notification to your designated contacts when a new exposure is detected. Alerts include: the exposed data type, the source, the estimated exposure date, the account affected, and initial risk assessment.

Monthly Exposure Summary Reports A structured monthly report covering: new findings during the period, findings from prior periods now confirmed closed, your domain's current risk posture on dark web sources, trend analysis (are exposures increasing, decreasing, or stable?), and benchmark context (how does your exposure compare to similar organisations in your industry?).

Quarterly Risk Review A structured quarterly conversation reviewing your cumulative dark web exposure profile, the effectiveness of response actions taken, any emerging trends in the types of data appearing for your domain, and recommendations for upstream security improvements that would reduce future exposure risk.

Compliance Documentation Annual summary of dark web monitoring coverage, findings, response actions, and response timelines – formatted for cyber insurance, Essential Eight compliance documentation, and Privacy Act incident management records.