Dark and deep web
Dark web threats to your brand, and how to find them.
Leaked customer data, stolen logins and offers to sell access turn up on breach forums, paste sites and private Telegram channels. Here's what each looks like, the warning signs, and how security teams get them taken down.
PostSample of 50 rows below: names, emails, phones, booking refs.3
Full file to first buyer. Telegram @dk77_data4 Escrow accepted.
- 1Your name, a big numberRecord counts are often inflated, but your brand in the title means it needs checking.
- 2New or unknown sellerNew accounts often resell old leaks. A seller's history shows what else they've posted.
- 3A sample as proofCheck it against your records to see if it's real, how recent it is and where it came from.
- 4Off to a private chatThe sale moves to Telegram, so the handle links this post to the seller's other listings.
Tap a numbered part of the post to see what it means.
How it works
How stolen data moves from a breach to a buyer.
Data is taken, advertised, sampled and sold, then reposted across channels. Each step leaves a trail that can be found and reported.
Supplier CRM exposedStaff laptop infectedSupport portal accessTake
Data or access is stolen.
Through a breach, a supplier, malware on a staff device, or someone on the inside.
Advertise
It's put up for sale.
A thread or channel post names the brand, the record count and what's inside.
Prove
A sample builds trust.
A slice of the data is posted so buyers can check it's real, and so can you.
Spread
It's sold, shared and used.
The file is resold and reposted, then used for phishing and account takeovers.
Types of dark web threats
Eight ways your data and access get traded.
Some posts sell what’s already been stolen. Others are planning the next attack. Pick one to see how it works.
Customer databases for sale
Threads on breach and hacker forums advertising a brand’s customer data, usually with a small sample as proof.
How it works: the seller posts a headline record count and a sample, then takes offers in private. The same file is often resold, or given away free later to build the seller’s reputation.
j.lee@solsticepay.com : W••••••6!
ops-admin@solsticepay.com : ••••••••
Leaked files on paste sites
Text and file-sharing sites where leaked data, logins and internal files are dumped, often anonymously.
How it works: pastes are quick to post and easy to share in forums and chats. Many are taken down by the site once reported, but they’re copied fast, so early detection matters.
Fresh dumps every day. Airlines, banks, retail. VIP access for full files.
Private Telegram leak channels
Invite-only Telegram channels and groups where leaked data is shared, sold or traded.
How it works: channels post samples and links to full files, and forward them to each other within hours. Because they’re private, they don’t show up in search, so someone has to be inside watching.
Includes a staff login to the internal support portal.
Stolen staff logins
Usernames, passwords and session cookies stolen from infected computers and sold as “logs”.
How it works: malware on a staff member’s or contractor’s home computer quietly copies everything saved in the browser. The logs are sold in bulk, and a working session cookie can let someone skip the password and two-step login.
Insiders offering access
Posts recruiting a brand’s staff, or insiders offering to sell access, data or account changes.
How it works: sellers advertise for employees at named companies, or staff offer access themselves. Spotting the post early lets security teams tighten access and watch for the activity being offered.
Supplier and third-party leaks
Your data exposed through a supplier, software provider or partner, rather than your own systems.
How it works: attackers breach one provider and advertise data from many of its customers at once. Your name appears in the listing even though your systems weren’t touched, so it’s easy to miss without monitoring.
Checked today. Replace if not working within 1 hour.
Account and card shops
Shops selling access to real customer accounts, loyalty points or card details tied to a brand.
How it works: accounts taken over with reused passwords are checked and listed for sale. Buyers drain balances, points or rewards, and customers contact the brand first when it happens.
Phishing kits for your brand
Ready-made copies of a brand’s login or payment pages, sold so anyone can run a phishing site.
How it works: the kit is uploaded to a new or hacked website and links are sent by SMS or email. Finding the kit early shows what’s coming, and the sites using it can be taken down as they appear.
In the data
What dark web threats look like in our cases.
Leaked data and breach posts we pursued for one airline group, January to June 2026.
of the leak posts we pursued were in Telegram channels and groups
of those Telegram leaks were in private or invite-only channels
came from a single private channel, reported together
of the leak posts we pursued were confirmed removed or shut down
Where the leaks were posted
- Telegram
Channels and groups78% - Breach forums
Hacker and carding forums14% - Paste sites
Text and file dumps8%
Most of it never touched a search engine. The leaks sat in private channels and forums, which is why someone has to be inside watching to find them.
Source: Unphish leaked data cases (posts on Telegram, breach forums and paste sites) for one airline group, January to June 2026. Removal rate excludes cases closed for other reasons or without enough information. Example names are illustrative. Figures are rounded.
Why it matters
Stolen data keeps working long after the breach.
A leak isn’t over when it’s fixed. The data is resold, reposted and used to make scams against your customers more convincing.
It’s sold more than once
The same file moves between forums and channels for months, often repackaged as a “new” leak.
It makes scams believable
Real names, emails and booking details let scammers write messages that look like they came from you.
It’s hidden from search
Private channels and closed forums don’t show up on Google. You only see them if you’re watching inside.
data breaches were reported to the OAIC in 2025, the most ever. Most were caused by malicious or criminal attacks.
Source: OAIC, Notifiable Data Breaches statistics, 2026Linked leaks
One leak, posted everywhere.
Once data is out, it’s forwarded between channels, copied to paste sites and reposted on forums. Treating the copies as one campaign stops the same file coming back under a new name.
- The same file name or sample rows in several places
- The same seller handle across forums and Telegram
- Forwards between private channels within hours
- Reposts that appear after the first one is removed
- FORUMThread: SOLSTICE PAY 2026 | 1.2M usersBreach forum, original postRemoved
- TGDaily Leaks (private)Sample and download linkRemoved
- TGDump Central (invite only)Forwarded the same postRemoved
- PASTEpaste site / 50-row sampleSample reposted as proofRemoved
- FILEfile host / full downloadLink shared in both channelsReported
Use case
How teams use Unphish to watch the dark web.
Leaked data, stolen logins and insider offers land with security, privacy and fraud teams at once. Unphish watches the forums, paste sites and private channels where they’re traded, checks what’s real and gets it removed.
Security
Know what’s already out there.
We flag stolen logins, insider offers and phishing kits, so access can be shut down.
Privacy and legal
Facts before the notification.
We capture what’s exposed and where, so breach decisions are made on evidence.
Fraud and customer
Warn customers before the scams start.
We spot account shops and leaked customer lists that feed phishing and takeovers.
Third-party risk
Your data, wherever it’s held.
We find your name in your own leaks and in supplier and partner leaks.
A sample of your customer data is posted in a private Telegram channel.
- 01Spotted
The post naming your brand, with a data sample and download link, is picked up and scored.
Sees an alert in the Threat Feed.
- 02Checked
An analyst captures the post, the fields in the sample and the channel details. We never buy the data from the seller.
Checks the sample against your records and approves enforcement.
- 03Taken down
The post and channel are reported to the platform and file host under their personal data rules, and escalated until removed.
Follows live status in the Enforcement Centre. No forms to fill in.
- 04Linked
Forwards, reposts and paste copies of the same file are grouped into one campaign and removed together.
Follows the whole campaign behind the posts.
- 05Reported
Removal is verified and the channels are watched for the file coming back.
Gets reporting for security, privacy and the board.
Case study · Airline group
100%
of the leaked data posts we pursued between January and June 2026 were removed or shut down.
Customer and loyalty data linked to the group was advertised, sampled and reposted across private Telegram channels, breach forums and paste sites, where it could feed phishing against members.
See Threat Intelligence →Client name withheld to protect confidentiality.
Jargon, decoded
The dark web terms worth knowing.
The words security, privacy and fraud teams use, in plain English.
- Infostealer
- Malware that copies saved passwords, cookies and card details from a browser and sends them to criminals. “Logs” sold by the thousand
- Combolist
- A list of email and password pairs, often from old breaches, used to try logins on other sites. name@email.com:password1
- Credential stuffing
- Trying leaked email and password pairs on another site, betting people reuse passwords. 10,000 login attempts an hour
- Initial access broker
- Someone who breaks into a company and sells that access to other criminals. “VPN access, admin rights”
- Paste site
- A website for sharing text quickly, often used to dump leaked data anonymously. a 50-row data sample
- Onion site
- A website on the Tor network, reached only with a special browser, often used by leak sites. ….onion
- Data sample
- A small part of a leaked file posted as proof, which can be checked against your records. “First 50 rows below”
- Ransomware leak site
- A site where ransomware groups publish stolen files from victims who don’t pay. a countdown timer
Warning signs
How to read a leak post.
A real-looking example
File: solstice_customers_2026.csv (184 MB)3
Fresh 2026 dump, never sold before.4
Includes emails, phone numbers and booking refs.5
Full file to first buyer, DM @dk776
- 1Private and invite-onlyIt won’t show up in search. Someone has to be inside the channel to see it.
- 2Forwarded from elsewhereA forward means there are other copies. Find the source and the other channels.
- 3Your name on the fileBrand names in file names are how leaks get found. Size hints at how much is in it.
- 4“Fresh” or “new” claimsOften an old leak repackaged. Check the sample against your records and past breaches.
- 5Named data fieldsThe fields listed tell you what’s exposed and what customers may be targeted with.
- 6Sale moved to private chatThe seller’s handle links this post to their other listings.
Checklist for your team
Found your data on the dark web? Here's what to do.
Leaks spread through forwards and reposts, so the first few steps matter most.
0 of 5 done
Tap each step to tick it off.
If personal information was exposed, report it
Want us to handle it? Request a takedown →
For your customers
Help customers stay safe after a leak.
Two short notes you can adapt for your website, emails, app or support replies. One warns people about scams that use leaked details. The other tells them what to do if they've been caught.
The copied version leaves blanks for your company name and official details.
Watch out for scams using your details
- We'll never ask for your password, one-time code or full card number by email, SMS or phone.
- Scammers may know your name or booking details. That doesn't make them us.
- Don't click links in unexpected messages. Log in through our app or website.
- Turn on two-step login and use a password you don't use anywhere else.
- Check solsticepay.com/security for updates.
Got a suspicious message? Report it at solsticepay.com/report
ExampleThink you've been scammed?
- Stop replying and don't click any more links.
- Change your password and turn on two-step login.
- Call your bank if you shared card or bank details.
- Contact IDCARE for advice on protecting your identity.
- Tell us what you received, so we can warn others.
Then keep an eye on your account for anything you don't recognise.
ExampleHow Unphish stops it
Remove the leak before it spreads.
Unphish watches the breach forums, paste sites and private channels where data is traded, checks what's real and gets posts and channels removed. Then we keep watching for the same file to come back.
- Every find checked by an analyst before a report is sent
- We never buy stolen data or pay sellers for access
- Reposts and forwards of the same file removed together
50-row customer sample posted with a download link
- DetectedPost naming the brand, with a data sample
- Evidence capturedPost, sample fields and channel details
- Confirmed by an analystSample checked with the client
- Reported to the platformPersonal data report for the post and file
- Linked copies foundSame file in another channel and a paste site, reported too
- Removed and watchedRemoval verified, reposts monitored
FAQ
Dark web questions, answered.
What's the difference between the dark web and the deep web?
The deep web is anything search engines don't index, like private groups, logged-in pages and invite-only channels. The dark web is a small part of it that needs special browsers such as Tor. Most leaked brand data we find sits in the deep web, especially private Telegram channels.
Can data on the dark web actually be removed?
Often, yes. Messaging platforms, paste sites, file hosts and many forums remove leaked personal data under their own rules, and whole channels can be shut down. Copies can resurface, so monitoring carries on after a removal.
How do you find leaks in private channels and forums?
Our analysts use research accounts to join the private channels, groups and forums where data is traded, and watch for your brand names, domains and data samples. Every find is checked before anything is reported, and we never buy stolen data.
Is a "database for sale" post always real?
No. Many are old leaks repackaged, data taken from a supplier, or fakes made to sell. Checking the sample against your own records shows what's genuine and how serious it is.
How long does it take to remove a leak post?
It depends on the platform and the host. Messaging apps and paste sites usually act on a clear report, while forums hosted offshore may need escalating, and some never respond.
What should we do if our data is posted?
Save the link and a screenshot without downloading the full file, check what's exposed, reset any affected passwords or keys, and check your data breach reporting obligations. Then report the post to the platform or host.
Does dark web monitoring replace our security tools?
No. It shows what's already out there about your brand so you can act on it, alongside the controls that protect your own systems.
By industry
Dark web threats in your industry.
Every sector's data is traded differently. See how it shows up in yours.
01
Airline and Transport
Loyalty accounts and customer data for sale.
02
Banking and Financial Services
Card data, account logins and insider recruiting.
03
Crypto
Exchange account leaks and wallet drainer kits.
04
Retail and E-Commerce
Customer databases and gift card shops.
05
Public Sector and Government
Leaked citizen records and staff logins.
06
Lottery and Gambling
Player accounts and balances for sale.
07
Fintech
Exposed API keys and customer data.
08
Non-Profit Organisations
Donor databases and supporter lists.
09
Film and Entertainment
Streaming account logins for sale.
Keep exploring
Try it
Real leak or recycled?
Five posts about Solstice Pay, our example company, which has about 2 million customers. Which would you treat as a real risk?
The quickest check: compare the sample with your own records. It tells you if a leak is real, recent and yours.
Found your data for sale?
Send us the link. We'll check it, capture the evidence and work to get it removed.