Dark web scan results list the work email addresses from your domain that appear in data stolen from other websites, with the breach each one came from, its date, and whether a password was included. The results show where your team’s details have leaked. They do not show whether anyone has used them, and that is the question the next four steps answer.
The report lands, there are eleven names on it, and the first reaction is usually either panic or a shrug. Neither is right. Here is how to read the results like someone who deals with them every week.
What does a dark web scan actually check?
It searches collections of stolen data that criminals trade or publish, for anything matching your email domain. Those collections come from breaches at other companies, not from yours.
When a website your team used is breached, the attackers take its user database. If someone signed up with their work email, that address, and often the password they used there, ends up in a file that gets sold, swapped and eventually dumped in public. Services such as Have I Been Pwned and the scan behind INDIGO IT’s free dark web report index those files and match them to your domain.
So a result does not mean your business has been hacked. It means a colleague used their work address on a site that was, and whatever they typed there is now in circulation.
How do you read the results?
Look at four columns before you do anything else: the email address, the source breach, the date, and what was exposed. Together they tell you how worried to be about each line.
- Email address only, no password. Low risk on its own. Expect more targeted phishing to that person, and tell them so.
- Email address with a hashed password from an old breach. Medium risk. Hashes get cracked, and old passwords get reused. If that person has used the same password anywhere since, assume it is known.
- Email address with a plain-text password from a recent breach. High risk. Treat it as a live credential until proven otherwise.
- The same address in several breaches. The person reuses passwords. That is the pattern attackers rely on, and it is the one worth a conversation.
One more thing the date tells you. A 2016 breach for someone who joined you in 2024 means they brought the habit with them, not the account. Still worth fixing, but the exposure is theirs rather than yours.
What should you do about the results?
Four actions cover almost every report we have ever walked a business through. Do them in this order.
- Change the exposed passwords, and any account where the same password was reused. Not a variation of it. The NCSC’s advice of three random words gives a password that is both strong and memorable.
- Turn on multi-factor authentication for every Microsoft 365 account, if it is not already on everywhere. A leaked password then gets an attacker to a prompt they cannot pass. Check it is really enforced, not just available.
- Give the team a password manager and ask them to use it for every work login. The NCSC recommends them because a manager removes the reason people reuse passwords in the first place.
- Tell the named people what was found, without blame. They are now the most likely phishing targets in your business, and a two-minute heads-up changes how they read their next unexpected email.
If a result shows a password that is still in use on a work system, treat it as an incident: reset it, check that account’s sign-in history, and look for mailbox rules you did not create. The ICO’s reprimand of two Welsh organisations in October 2026, after a single weak password on a forgotten account led to a ransomware attack, is a reminder of how far one credential can travel.
What a scan cannot tell you
A clean result is good news, not a guarantee. The scan only sees data that has been published or traded widely enough to be collected. Credentials stolen last month and sold privately will not be in it yet, and data stolen by malware on a laptop may never appear in a breach file at all.
Nor does a scan catch the typo domains. Criminals register near-misses of real company names to send convincing invoices, and no breach database will ever list those.
It also says nothing about your own systems. Whether your firewall is patched, whether former staff still have accounts, whether backups would survive ransomware: none of that is in a dark web report. It is one check among several, which is why INDIGO IT, a managed IT support and cyber security provider in Camberley, Surrey, treats it as the start of a conversation rather than the end of one.
If you have not run a scan on your domain, our free dark web report does it for UK businesses and explains the results in the terms above. If you have one and want a second opinion on what it means, speak to Matt. Reading someone else’s breach data is a strange way to spend a morning, but it is a cheap way to find out where your team’s habits need help.
Frequently asked questions
What do dark web scan results show?
They list work email addresses from your domain found in stolen data from other websites, with the breach each came from, its date and whether a password was exposed. They show where credentials have leaked, not whether anyone has used them.
Does appearing in a dark web scan mean my business has been hacked?
No. It means a colleague used their work email address on a website that was later breached. The risk is that the exposed password is reused on a work account, which is why resetting it and enforcing multi-factor authentication are the first two actions.
What should I do if my email is found on the dark web?
Change the password on the breached site and anywhere you reused it, turn on multi-factor authentication, and move to a password manager so each login is unique. Expect more targeted phishing to that address and read unexpected emails with that in mind.
How can I get a free dark web scan for my business?
INDIGO IT provides a free dark web report for UK businesses. You enter a work email address, the scan checks your domain against known breach data, and the report lists what was found with guidance on what to review next.
