Is my company's information on the dark web?

The short answer

There's no way to fully answer whether your company's information is on the dark web, but you can watch for a clear warning sign. When a small business owner asks "is my information on the dark web?", the most useful version of that question is narrower. Has a ransomware group posted my company's name or data on a ransomware leak site?

A leak-site posting is not the only sign worth watching, so I also cover the signals that sit next to it, like exposed work accounts. I'm writing for any small business, whether that's an accounting office, a local contractor, or a law firm. Most hold sensitive customer information and answer to customers for it.

How companies end up named on the dark web

Ransomware started as a way to lock files and demand payment to unlock them. Over time, attackers also began stealing data and threatening to release it if they aren't paid. The CISA #StopRansomware Guide calls the combination of encryption and data theft "double extortion," and notes that some groups skip the encryption entirely and use the threat of release as their only lever. A ransomware leak site is where that threat becomes public. The group posts the names of organizations it claims to have breached, as proof and as pressure to pay.

A posting is a claim made by a criminal group, not a verified report. Groups have reasons to exaggerate what they took. If you track leak-site mentions of your domains, treat each one as a reason to investigate, not a conclusion.

Why being named cuts so deep

Seeing your company's name on a leak site is a gut punch. It's a mix of disbelief, uncertainty, and embarrassment, made worse by knowing an attacker got a foothold.

I believe most teams know firsthand that there is no certainty in security. Businesses have to rely on layers of assurances, both from a protection perspective and from a verification perspective. The honest answer to "is my information out there?" is one that can be cross-validated with your other controls. Seeing no findings in dark web posts gives added confidence.

Is my email exposed?

When people ask about their email, they usually mean something slightly different. Have the usernames and passwords for our work accounts been exposed somewhere? That is a separate signal from a leak-site posting, and it matters for its own reasons. CISA lists compromised credentials as one of the common ways ransomware and data extortion actors get in, alongside phishing, exposed internet-facing systems, and third parties such as managed service providers. The Verizon 2026 Data Breach Investigations Report found ransomware in 48% of the breaches it analyzed. In its look at small and medium-sized businesses, credentials were among the data compromised in 31% of breaches.

The practical response is the same whether or not you ever find an exposed account. CISA recommends phishing-resistant multifactor authentication for all services, particularly email, VPNs, and accounts that reach critical systems, along with unique passwords of at least 15 characters. Checking for exposed accounts tied to your domains tells you where to start, and strong authentication limits what an exposed password is worth.

What happens if your information is on the dark web?

If your company shows up on a ransomware leak site, you can't undo the posting, but you can control how you respond. Here is how I'd approach it, with the official guidance behind each step.

Don't pull the plug in a panic

Don't turn off machines or devices during the initial panic. CISA's guidance is to isolate affected systems, by unplugging them from the network or taking the network offline, and to power devices down only if you can't disconnect them, because shutting down destroys evidence held in memory. CISA also suggests coordinating by phone or other out-of-band channels, since attackers who still have access may be watching your email.

Stick to the facts and size the blast radius

Treat it seriously, but verify and understand the potential blast radius. Don't make assumptions; just stick to the facts. Which systems and which data does the claim describe? Does it match anything in your own logs or incident history? A ransomware event can also be evidence of an earlier compromise that was never resolved, so the posting may be the end of a story that started weeks before.

Bring in help and report it

• Treat it as an incident. Bring in your IT provider or an incident response firm and preserve logs and evidence rather than wiping and rebuilding right away.
• Report it. CISA's checklist points victims to CISA, their local FBI field office, the FBI Internet Crime Complaint Center (IC3), or a U.S. Secret Service field office.
• Call your cyber insurance company. CISA lists it among the stakeholders to bring into the response.
• Talk to legal counsel about notification duties, which depend on what data was involved and whose it was.

Close the doors they may still have

Breaches often involve stolen credentials, so check for continued access. CISA's checklist covers reviewing and disabling remote access, VPNs, and other public-facing entry points used in the breach, resetting passwords for affected systems once the environment is clean, and taking care not to reinfect clean systems when you restore from offline backups.

Be careful with ransom demands and with the leak sites themselves

The FBI's IC3 ransomware guidance is direct. The FBI does not support paying a ransom, paying doesn't guarantee you'll get any data back, and it encourages attackers to target more victims. Take caution, too, if you're thinking about visiting the actual leak sites yourself. This is an adversarial setting.

Take law firms, for example

Some industries carry duties on top of the ones every business has, and law firms are a good example. The American Bar Association's Formal Opinion 483 calls law firms "inviting targets for hackers" because they are custodians of highly sensitive information. It concludes that lawyers must make reasonable efforts to monitor the technology and office resources connected to the internet, external data sources, and external vendors that handle their data, so that recognizing a breach isn't left to happenstance.

The same opinion says that when material client information was accessed, or is reasonably suspected to have been accessed, lawyers must tell affected current clients and keep them informed as the investigation develops. It also recommends having an incident response plan before you need one. Those ethics duties sit alongside statutory breach notification laws, which the opinion notes exist in all fifty states, so breach counsel belongs on the first call list.

For a small firm without a security team, that is a lot to watch by hand. That's where threat intelligence built for law firms helps by turning those outside signals into findings rather than a raw feed.

No findings isn't the same as no problem

It's like the check engine light. It doesn't have to come on for there to still be a significant concern. And when it does come on, it's wise to take it seriously even though it could be a loose gas cap. If it didn't exist at all, problems might compound.

Responsible car ownership means not just minding the check engine light, but it does mean not ignoring the indicators. A dark web posting isn't an exclusive indicator of a successful breach, but it's certainly one you shouldn't ignore and keep driving.

Other outside signals worth watching

By the time a group posts a victim's name, the attack has already happened. These signals are worth watching too.

Exposed work accounts

Compromised credentials are one of the common ways in, so exposed accounts on your company email domains are worth knowing about. Watching for them pairs naturally with turning on stronger authentication.

Lookalike domains

Someone can register a domain that imitates yours with a typo, a swapped character, or a different ending. A lookalike can send or receive email and host fake login pages aimed at your staff and clients. Watching for lookalike domain registrations pairs well with publishing a DMARC policy, which CISA notes lowers the chance of spoofed email from your own domain.

Your vendors' names and incidents

Watch for your vendors being named on ransomware leak sites, and for security incidents reported at the service providers you rely on. CISA notes that managed service providers have been an infection vector for ransomware affecting many of their client organizations, so a vendor's bad day can become yours.

Your brand and certificates

Watch for social accounts impersonating your business and for unexpected TLS certificates issued for your domains. Both are quieter signals that someone may be trying to pose as your business.

A practical checklist

• Turn on phishing-resistant multifactor authentication for email, remote access, and admin accounts.
• Publish a DMARC policy for your email domains.
• Keep offline backups and test that you can restore from them.
• Write a one-page incident response plan with phone numbers for your IT provider, your cyber insurance company, and legal counsel.
• Know where to report, whether that's CISA, your local FBI field office, or IC3.
• List your key vendors and how each would notify you of an incident.

Where ThreatHarvest fits

I built ThreatHarvest for small businesses that don't have a security team. You register what identifies your organization, like your domains, public IPs, brand keywords, and social handles. ThreatHarvest tracks ransomware leak-site postings that reference your domains, along with signals like lookalike domains, and surfaces findings matched to your identifiers rather than a raw feed. Findings appear in your dashboard, and you can choose to get a daily email when there are new ones.

Guided setup takes about 15 minutes. There are no agents to install, no required sales call, and no long-term contract, and you can cancel anytime. Plans have a published monthly price.

If I could leave you with one thing, it's this. Don't focus on what you can't control, the unknown unknowns in particular. Strive to reduce the unknown knowns, like the indicators that readily exist where you simply aren't looking.