Sound familiar?
- A staff member got an email saying their password was in a breach
- Someone logged in to Microsoft 365 from another country
- Customers received invoices from a lookalike of your email
- An IT company offered you a scary 'dark web report'
- You do not know which staff reuse work passwords elsewhere
- Your insurer asks how you monitor for compromised credentials
Key facts
- Monitoring tells you when your addresses appear in known breach data; it cannot remove them
- Have I Been Pwned domain search is free for domains with up to 10 breached addresses
- Larger domains and HIBP's stealer log search need a paid subscription
- HIBP can email you when your domain appears in a new breach, without a subscription
- Microsoft Entra ID Protection flags leaked credentials; full risk reports need Entra ID P2
- The real protection is MFA, unique passwords and a password manager
- Set-up: £45 an hour + VAT; ongoing alerts under monthly plans
What dark web monitoring actually is
When a website or service is breached, the stolen data, often email addresses and passwords, is traded, leaked and eventually published. Malware called an infostealer also harvests saved passwords straight from infected computers into files known as stealer logs. Dark web monitoring services collect this material and tell you when an address on your domain appears in it.
That is useful, but it is worth being clear about what it is: a notification service for data that has already leaked. It is not a shield, and the phrase "dark web" is often used to make a fairly ordinary lookup sound more dramatic than it is.
What it can and cannot do
| It can | It cannot |
|---|---|
| Tell you which staff addresses appear in known breaches | Remove your data from criminal forums or files |
| Show which breach it came from, so you know what was exposed | See every private forum, chat group or unpublished dump |
| Flag addresses found in stealer logs, which suggests an infected device | Stop a breach at a third-party website |
| Prompt password resets and MFA checks | Tell you whether the leaked password is still in use |
A clean report does not mean you are safe. A hit does not always mean an account is compromised, especially for old breaches. The value is in acting on the results.
Have I Been Pwned domain search
Have I Been Pwned (HIBP) is the best-known public breach database. Its domain search lets the owner of a domain see every address on it that appears in a breach HIBP holds. You prove you own the domain first, for example with a DNS TXT record or an email to an address at the domain, which is where our domain and DNS support comes in.
- HIBP's subscription page lists domain search as free for domains with up to 10 breached addresses.
- Domains with more than 10 breached addresses need a paid subscription to search.
- You can add your domain to the HIBP dashboard and get an email when it appears in a new breach without paying.
- Stealer log search is only available on paid tiers.
For most small businesses, HIBP gives the same core answer as expensive monitoring products: which addresses, which breaches, and when.
Microsoft 365: leaked credentials detection
If you use Microsoft 365, Microsoft Entra ID Protection includes a leaked credentials risk detection. Microsoft checks credentials found in leaks against your users' passwords and flags matches as high risk. Microsoft lists it as a non-premium detection, but the fuller risky sign-in reports and risk-based Conditional Access that act on it automatically need Entra ID P2. For businesses that sync passwords from an on-site server, Microsoft says password hash synchronisation must be turned on for it to work.
What to do when you get a hit
- Check the breach: what was exposed, and how old is it?
- Reset the password on the affected account and anywhere it was reused.
- Confirm MFA is on and check recent sign-ins and inbox rules in Microsoft 365. See password and MFA setup.
- For stealer log hits, treat the device as infected: scan or rebuild it before changing passwords on it. See malware removal.
- If personal data you hold was involved, the ICO says reportable breaches must be reported within 72 hours of becoming aware. See GDPR and IT compliance.
Long term, a password manager and the NCSC's advice to use three random words for passwords you must remember reduce reuse, which is what turns someone else's breach into yours.
How dijitul helps, and pricing
We verify your domain with HIBP, run an initial search, review Entra ID risk detections, deal with any findings and set up alerts so new breaches come to us. Set-up is £45 an hour + VAT. Handling alerts, password resets and sign-in reviews each month fits within the Business plan at £50 a month + VAT or the Complete plan at £99 a month + VAT, which adds Microsoft 365 helpdesk support. See also phishing protection.
What it costs
Support plans from £25 a month + VAT, or £45 an hour + VAT for one-off fixes. Pick a plan if you want it looked after every month, or pay by the hour for a one-off job.
Essential
Keep it updated, backed up and watched.
- Website software updates (core, plugins, themes) applied and checked
- Daily backups
- Uptime monitoring
- Security monitoring
Business
Updates plus an hour of fixes every month.
- Everything in Essential
- 1 hour of fixes or changes every month
- Priority support
Complete
Website and your team's IT, covered.
- Everything in Business
- 3 hours of fixes or changes every month
- IT and Microsoft 365 helpdesk for your team
No plan? The first 30 minutes are the minimum charge, then we bill in 15-minute blocks.
Frequently asked questions
Is dark web monitoring worth paying for?
For most small businesses, free and low-cost tools such as Have I Been Pwned domain search give the same core result: which addresses appeared in which breach. The value is in acting on it. dijitul sets it up and handles the findings at £45 an hour + VAT.
Can you remove our data from the dark web?
No. Nobody can reliably remove leaked data once it has been copied and traded. What you can do is make it useless: reset exposed passwords, stop reuse and enforce MFA so a stolen password alone is not enough.
How does Have I Been Pwned domain search work?
You verify you own the domain, then HIBP shows every address on it found in breaches it holds. HIBP says it is free for domains with up to 10 breached addresses, with a subscription needed for larger domains and for stealer log search.
What is a stealer log?
A file of usernames, passwords and browser cookies taken from an infected computer by infostealer malware. A stealer log hit is more serious than an old breach, because it suggests a current infection. dijitul treats that device as compromised.
Does Microsoft 365 check for leaked passwords?
Microsoft Entra ID Protection has a leaked credentials detection that flags users whose credentials appear in leaks. Microsoft lists it as non-premium, but the full risk reports and automatic responses need Entra ID P2.
Do we have to report a breach to the ICO?
If a breach of personal data you are responsible for is likely to risk people's rights and freedoms, the ICO says you must report it within 72 hours of becoming aware. A staff address in someone else's breach is usually not your reportable breach, but check each case.
Related
Hand it over and stop worrying
Updates, backups, monitoring and fixes from £25 a month + VAT. Real UK people on the phone.