Somewhere on the dark web right now, there is a database containing billions of usernames, email addresses, and passwords collected from years of data breaches. LinkedIn in 2012. Adobe in 2013. Yahoo in 2016. Facebook in 2021. The list runs to thousands of companies.
The question is not whether your credentials are in one of those databases. Statistically, they almost certainly are. The question is what happens next — and whether you have taken the steps that make those stolen credentials worthless.
This guide explains exactly what occurs after a data breach, how attackers monetise your stolen information, and the specific steps that cut your risk to near zero.
How Credentials End Up on the Dark Web
Data breaches happen when attackers gain unauthorised access to a company’s database — typically through a software vulnerability, a misconfigured server, or a phishing attack targeting an employee with system access.
When a company stores passwords properly, they are hashed — converted into a scrambled string using a mathematical function that cannot be reversed directly. A good hash function means that stealing the database does not immediately give attackers your actual password.
The problem is that many companies, particularly older or smaller ones, have stored passwords poorly — either in plain text, using weak hashing algorithms like MD5, or without salting (an additional layer that makes hash-cracking harder). In those cases, once the database is stolen, your actual password is recoverable within minutes using freely available tools.
Once attackers have a database of credentials, several things happen in rapid succession.
Stage 1: The Database Is Sold on Dark Web Markets
Within hours or days of a major breach, the stolen data appears on dark web marketplaces — websites that operate on the Tor network and are not accessible through normal browsers. These markets operate like any e-commerce platform: listings, prices, buyer reviews, and seller ratings.
A database of 10 million email/password pairs might sell for a few hundred dollars. A targeted list of credentials for financial services — banking logins, crypto exchange accounts — commands a premium. Individual verified account accesses can sell separately for specific platforms.
The people buying this data are not always sophisticated hackers. Many are simply opportunists who purchase pre-breached credentials and use automated tools to do the rest.
Stage 2: Credential Stuffing Attacks Begin
Here is the attack that makes password reuse catastrophically dangerous.
Credential stuffing is an automated attack where attackers take a list of leaked username/password combinations and try them against hundreds of other websites simultaneously. They use bots that can test thousands of combinations per minute.
The logic is simple: if you used the same password for the breached LinkedIn account as you use for your bank, your email, or your business software — all of those accounts are now at risk, even though those platforms were never breached.
This is why security experts are so emphatic about password uniqueness. The breach happens at one company. The damage spreads to every account where you recycled that password.
Credential stuffing attacks have been responsible for some of the most significant account compromises in recent years — not because attackers found a sophisticated vulnerability in the target platform, but because users made it unnecessary to look for one.
Stage 3: The Successful Logins Are Sorted and Monetised
When a credential stuffing attack succeeds — when a leaked email/password combination opens an account on a different platform — the attacker has several options depending on what they have accessed.
Email accounts are among the most valuable. Access to your email means access to password reset links for every other service linked to that address. An attacker who controls your email can systematically take over every other account you own.
E-commerce accounts with saved payment methods can be used for fraudulent purchases. Items are typically ordered for delivery to an address the attacker controls, or gift cards are purchased and immediately redeemed.
Business accounts — project management tools, cloud storage, accounting software — may contain sensitive client data, financial records, or intellectual property that can be sold or used for further attacks.
Social media accounts are used to run scams targeting your followers, spread misinformation, or hold the account hostage for ransom.
Stage 4: Your Data Enables Targeted Phishing
Beyond credential stuffing, your leaked data enables something more personalised and more dangerous: spear phishing.
Knowing your name, email address, employer, and the services you use (all discoverable from breach data combined with public social media), attackers can craft highly convincing phishing emails that reference specific details about you.
“Dear [Your Name], we noticed a suspicious login to your [Real Service You Use] account from a location in Germany…” is far more convincing than a generic template. The attacker did not guess that you use that service. They knew because your email address appeared in that service’s breach data.
This is the compounding risk of data breaches: each piece of information leaked makes subsequent social engineering attacks more believable.
How to Know If Your Credentials Have Been Leaked
The fastest way to check is through Have I Been Pwned (HIBP), a free service run by security researcher Troy Hunt that monitors breach databases and allows you to check whether your email address appears in known breaches.
Our Have I Been Pwned Checker tool lets you run this check directly — your email is checked using a privacy-preserving method that means not even the tool sees your full address.
If your email appears in a breach, note which service was breached and when. This tells you whether any passwords you created before that date and used on that service may now be compromised.
What to Do Right Now
If you are in a breach:
1. Change the password on the breached service immediately. Even if the breach happened years ago, change it now.
2. Change the same password everywhere else you used it. This is the critical step that most people skip. Every site where you reused that password is now vulnerable.
3. Enable two-factor authentication on your email account first. Your email is the master key to every other account. Protect it with 2FA immediately — this single action dramatically reduces the damage that can be done even with a leaked password.
4. Enable 2FA on all other important accounts. Banking, cloud storage, business software, social media.
Going forward:
Use a unique password for every account. This is the rule that eliminates credential stuffing as a threat. If each of your accounts has a different password, a breach at one service cannot cascade to others.
Use a password manager. The only reason people reuse passwords is because remembering unique passwords for dozens of accounts is genuinely difficult. A password manager solves this problem — you remember one strong master password, and the manager generates and stores unique passwords for everything else.
Use our Password Generator to create strong, random passwords that no brute-force attack can crack. Generated passwords are never sent to any server — they exist only in your browser.
Check your email addresses periodically. Breaches are discovered and published months or years after they occur. A credential that was fine when you last checked may have appeared in a new breach disclosure since then.
The Uncomfortable Truth About Data Breaches
You cannot prevent a company you do business with from suffering a data breach. That decision is entirely outside your control. What you can control is how much damage that breach can do to you.
A person who uses unique passwords and two-factor authentication across all their accounts suffers almost no harm from a credential breach. The leaked data is simply worthless — the password does not work anywhere else, and even if it did, 2FA would block the login.
A person who reuses passwords and has no 2FA can find themselves locked out of their email, banking, and business accounts within hours of a breach being sold on a dark web market.
The technical steps required to protect yourself are neither complicated nor expensive. They require about 30 minutes to implement and maintenance of roughly five minutes a week thereafter.
Thirty minutes of action today against a risk that is actively growing and will not wait for a convenient time to materialise.