How do I check if my data has been sold on the dark web?
Key takeaways
- Monitoring searches known criminal marketplaces, paste sites and stealer-log repositories, and a hit confirms circulation rather than identifying the original breach.
- Search on the identifiers that matter for your risk: email, phone number, PAN, and any government or banking identifier you have used online.
- Never upload your own credentials to a 'check my data' website, because that is the standard way people lose the accounts they are trying to protect.
- An email and phone number appearing together is normal; a stealer log containing a password is a takeover credential and needs immediate password reuse remediation.
- An Ernakulam hospital lost over 800GB of patient data in March 2026, and a Kochi hospital was listed by the same ransomware group that month.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What does a dark web monitoring search actually cover?
Three source types, and knowing which one produced a hit changes your response. Criminal marketplaces where bulk datasets are advertised and sold. Paste and leak sites where credentials or records are posted free, often to build credibility. And stealer-log repositories, which are the automated output of malware that grabbed saved browser passwords, cookies and autofill data from infected machines. Stealer logs are the most dangerous for an individual because they often contain live session cookies. A monitoring service searches all three continuously and reports a match against the identifiers you nominate, which is why choosing the right identifiers matters more than the depth of any single search.
How do I check without creating a second problem?
Four rules. Use a service that searches from its own infrastructure and does not require you to type your password into the check page, because sites offering free leak checks harvest exactly the credentials people want to verify. Nominate the identifiers yourself rather than uploading a file of personal data. Run the check from a device you trust, and treat any email asking for more personal identifiers as a red flag. And do not act on information found on a criminal forum yourself: do not reply, do not transact, and do not download the listing to 'look'. Hand any evidence you find to your incident responder, a CERT-In empanelled digital forensics firm, or the police.
What should I do if my data is found?
Act in a ranked order. If a stealer log contains a password, change that password everywhere it is reused, starting with the email account, and change it from a clean device. Revoke all active sessions on every affected service, because cookies survive password changes. If a bank or UPI credential appears, call the bank's fraud helpline the same day, request a transaction limit and a new card, and enable the bank's channel-based confirmation. If a PAN, Aadhaar-linked identifier or government document identifier appears, file on cybercrime.gov.in and helpline 1930, and consider a PAN profile update through your bank. And if the exposure relates to a company rather than you personally, the CERT-In six-hour clock applies to the organisation.
Why is exposure in the hands of criminals a real problem in India?
Because the datasets are specific and current. An Ernakulam hospital lost over 800GB of patient data in March 2026, and a Kochi hospital was listed by the same ransomware group that month, so Indian healthcare records, including name, address, contact details and sometimes clinical information, are actively traded rather than hypothetical. Telecom and identity data are equally industrially produced, with Indians losing over Rs 22,800 crore to telecom fraud and impersonation scams in 2026. A market of that shape means a leaked identifier is not a curiosity, it is inventory, and the correct response is remediation and monitoring rather than shock.
| What was found | What it indicates | Required response |
|---|---|---|
| Email and phone number together | Contact list in a leaked dataset | Enable phishing-resistant MFA, watch for targeted lures |
| Password in a stealer log | Live credential from an infected device | Change password everywhere, revoke sessions, from a clean device |
| Session cookie or token | Account may still be accessible without a password | Revoke sessions now, then change the password |
| Bank, UPI or card details | Direct financial fraud route | Bank fraud helpline the same day, card replacement, transaction limit |
| PAN or Aadhaar-linked identifier | Identity fraud exposure | Report on cybercrime.gov.in and 1930, PAN profile update via bank |
| Name, address, medical or employer data | Targeted fraud or extortion potential | Alert the relevant institution, monitor credit, report to police |
What are the frequently asked questions?
Get a straight answer on this
Send us the identifiers you want checked and we will return a fixed-price exposure search with a remediation checklist.
Send us the details See pricing