Have you received a Dark Web alert?

Not necessarily.

A Dark Web finding means that information related to your domain has been found somewhere where compromised data is shared, collected, or sold. It may come from a completely different service that an employee previously used with their work email address.

For example:

An employee may have used their work email to create an account on an external website. If that website is later affected by a data breach, the email address -and possibly a password – may appear in a leaked database, even though your Microsoft 365 account has not been compromised.

This happens quite often.

Our Dark Web monitoring sends an alert if an email address using your domain appears in leaked data, combolists, or similar sources. This does not necessarily mean that there is an active mailbox in your company with that address.

It may be:

• a former employee’s email address
• an old alias
• an address that existed in a previous mail system
• an address used for testing or sign-ups
• an address that has been guessed or generated automatically
• an address that has never been active but still appears on a list

If the email address does not exist in your Microsoft 365 environment, and there are no signs of misuse, there is usually no need for further action.

If the user has been properly removed and the account is no longer active, this is normally not an urgent issue.

However, we still recommend checking whether:

• the address still exists as an alias
• emails are being forwarded from the address
• the user still has access to external systems
• the password has been used elsewhere

If the account has been closed, the license removed, and access has been disabled, the risk is usually limited.

Then the finding is most likely related to an address that was generated, collected, guessed, or added to a list without ever being a real active account.

This can happen because lists of compromised data often contain mixed information. Some data is real, while other data may be old, duplicated, misspelled, automatically generated, or linked to previous systems.

If the address does not exist in your environment, and we cannot see any signs of activity in Microsoft 365, everything is generally fine.

A combination list — often called a combolist — is a list of usernames/email addresses and passwords that has typically been compiled from several different data breaches, forums, paste sites, or previously compromised datasets.

This means the list does not necessarily come from one specific attack against your company.

In many cases, combolists contain reused credentials from older exposures or other leaked datasets.

Sometimes the source of a finding cannot be disclosed or identified.

This may be because:

• the original source is not known
• the data has been collected from several different breaches
• the leak cannot be publicly linked to one specific service
• the affected organization has not publicly confirmed the incident
• there is not enough metadata to determine the source

In other words, “Not disclosed” does not automatically mean that the finding is more serious. It often simply means that the original source cannot be confirmed.

The alert may include two different dates:

“Found on the Dark Web”

This is the date when the information appears to have been found or registered in a leaked source.

“Added to the DWID platform”

This is the date when the finding was added to the monitoring platform and became visible to us.

This means that a finding can be old, even if the alert has only just been sent.

If the password mentioned in the alert is still being used anywhere, it should be changed immediately.

This applies to:

• Microsoft 365
• private services
• social media
• webshops
• industry portals
• internal systems
• any other accounts where the same password may have been used

Never use the same password across multiple services.

We also recommend enabling multi-factor authentication wherever possible.

If the password is no longer used anywhere, there is usually no need for urgent action.

However, we still recommend that you:

• keep an eye out for suspicious login attempts
• stay alert to phishing emails
• avoid reusing old passwords
• use strong and unique passwords
• enable multi-factor authentication on important accounts

Old passwords can still be useful to attackers if they try to guess password patterns or attempt access to other services.

You do not necessarily need to reply if:

• the email address mentioned does not exist
• the account has been closed
• the password is no longer used
• you do not see any signs of suspicious activity

If you are unsure, you are always welcome to contact us.

It is especially relevant to contact us if:

• the address is still active
• the password is still being used
• you see suspicious login attempts
• the user receives unusual emails
• there are signs of forwarding rules or account changes
• you are not sure whether the account still exists

Yes.

If you contact us, we can help check whether the email address exists in your Microsoft 365 environment and whether there are any signs of suspicious activity.

We can check, for example:

• whether the account exists
• whether it is active or disabled
• whether any aliases exist
• whether there have been unusual login attempts
• whether there are suspicious forwarding rules
• whether multi-factor authentication is enabled
• whether the user has permissions that should be reviewed

We send these alerts to help you react quickly if information related to your domain appears in leaked datasets.

The purpose is not to cause unnecessary worry, but to give you the opportunity to take action if the information is still relevant.

In many cases, everything is fine  especially if the address is old, the account has been closed, or the password is no longer used. But if the information is still active, a quick response can make a big difference.

As a minimum, we recommend that you:

• use unique passwords for all services
• use a password manager
• enable multi-factor authentication
• remove old users and aliases
• review access permissions regularly
• stay alert to phishing emails
• avoid using work email addresses for private or irrelevant services
• contact ITGuy if you are unsure about a finding

Cybersecurity is rarely about one single solution. It is about reducing risk over time and responding quickly when something needs attention.