The Dark Web Isn’t Someone Else’s Problem. It Could Be Yours

A young man in a black hoodie is having a productive evening.

Rain drags the streetlights down the window behind him. Two monitors bleach the color from his face. On one, green text races toward some terrible conclusion. On the other, money moves between people with no names. He taps at the keyboard, pauses for a second, reaches over to take a bite of a sandwich and brushes a crumb off his keyboard. 

Then he gets back to work.

Somewhere far away, someone is about to have a very bad morning.

You know this room. You’ve seen it in movies, in television dramas, in the stock photo above an article that tells you a company you trusted has exposed your Social Security number for the third time. Sometimes the equipment gets an upgrade. Nobody ever buys the guy another hoodie.

This is where we tend to put the dark web: Somewhere underground, beyond our familiar internet, inhabited by people who know things that we don’t. A place you need special skills to enter and poor judgment to explore. Every click takes you further into trouble. Drugs, stolen identities, the worst material imaginable. Somebody who supposedly knows somebody who can have a person killed. Prices in a currency you’d have to look up.

Even the name does some of the work: the dark web. It sounds like the part of the internet the city stopped maintaining. You can almost hear water dripping onto concrete.

There’s something reassuring about that picture, though. You can close your laptop, carry a plate into the kitchen and leave those people to whatever the hell they’re doing. Tomorrow, you’ll use the internet to check the weather or return a pair of shoes.

But the company that sold you the shoes has information about you. So does your employer. So does the office where you filled out six pages of medical forms because, for some reason, they needed you to write your address three times.

If someone steals those records, they can offer them for sale without you ever opening the dark web or visiting a criminal marketplace. Being an ordinary customer is enough.

In this article:

Robeson Jennings spends his days looking for threats across the internet, including the dark web. As senior vice president of global services and intelligence at cybersecurity company ZeroFox, he investigates criminal activity in these spaces. What his team finds isn’t always the stuff of Hollywood nightmares.

“We see a lot of trading of stolen data,” Jennings says.

The dark web also has uses that don’t fit that picture. ProPublica publishes news there. Newsrooms use tools such as SecureDrop to let sources share documents with greater privacy. Some people have good reasons to visit. Others become involved without ever choosing to, when information they gave a company ends up for sale.

I want to understand that connection. What makes the dark web “dark,” how to get into it, what someone can do with the information sold there and how much protection staying away offers.

What makes it dark?

The “dark” in dark web refers to the way websites are accessed and concealed.

A website can look ordinary once it loads, but to reach a Tor onion site, you need to connect to the Tor network. Tor uses what are known as “onion services” to hide the underlying address of the servers hosting them, making it harder to establish where they’re running.

Cybersecurity company Prey estimates there are 2.5 million to 3 million daily Tor users. That isn’t a count of people visiting dark-web sites — Tor also lets people browse the ordinary internet with greater privacy.

Adding to the confusion is the “deep web,” a name that makes your inbox sound considerably more sinister than it is. The term covers content that ordinary search engines don’t index, including your email and online bank statements. You already use that part of the web in a regular browser. The names sound like successive levels in a video game, but you don’t pass through your checking account on the way to a criminal marketplace.

In 1995, researchers at the US Naval Research Laboratory began working on the technology that would become Tor. They wanted to make it possible to communicate online without revealing who was contacting whom. Their work produced early designs for onion routing, the foundation of Tor. 

The Tor network launched in 2002, with its code publicly available. The nonprofit Tor Project followed in 2006.

These protections are designed to make identification harder, but they don’t guarantee that nobody can ever identify you.

Silk Road gave this privacy technology a different sales pitch in 2011: You could use it to buy drugs. Its founder, Ross Ulbricht, combined a marketplace accessible through Tor with a bitcoin payment system.

By September 2013, Silk Road had nearly 13,000 listings for controlled substances, according to evidence summarized by the Justice Department after Ulbricht’s trial. Undercover agents bought heroin, cocaine, ecstasy and LSD from its vendors. Authorities shut the site down and arrested Ulbricht in 2013. He was sentenced to life in prison but received a full pardon from President Donald Trump and was released last year.

Silk Road gave the dark web a reputation it’s still living with. But is that really all the dark web amounts to? A place to buy drugs, find child sexual abuse material and supposedly hire hit men?

Yes, the scary stuff is real

In April 2025, FBI agents searched a Los Angeles apartment they suspected was being used by a major drug distributor on what the agency refers to as the darknet. In a bedroom, they found the equipment of a small shipping business: a printer, postage stamps, addressed envelopes and a shredder. There was also what appeared to be large quantities of drugs, according to the bureau’s account.

The four people arrested allegedly operated seller accounts across 17 darknet markets, accepting cryptocurrency for drugs they packaged and shipped through the US Postal Service. The FBI describes these marketplaces as having features any online shopper would recognize, including shopping carts, promotions and customer reviews. Someone still had to print the labels and get the packages out the door.

The search was part of Operation RapTor, an international effort whose results the Justice Department announced in May 2025. Authorities reported 270 arrests across 10 countries and seizures of more than $200 million in cash and digital assets. Silk Road had been gone for more than a decade. The business hadn’t disappeared with it.

Other investigations make for much harder reading. In April 2025, Europol announced the dismantling of Kidflix, a platform distributing child sexual abuse material on the dark web. The agency reported that 1.8 million users had logged on between April 2022 and March 2025. The investigation had resulted in 79 arrests; authorities also identified and protected 39 children, according to an account from blockchain intelligence firm TRM Labs.

Those children are a reason to be careful with the word “misconception.” The legitimate uses of privacy technology don’t make that abuse any less real.

At this point, staying away sounds like an excellent idea. But stolen-data markets involve people who never chose to participate. Someone else offers their information for sale, and they might learn about it later through a company email explaining that their privacy is very important.

Europol’s 2025 Internet Organised Crime Threat Assessment describes personal information and access to accounts as key commodities in cybercrime. Credentials and datasets are sold, resold and repackaged across dark-web forums, encrypted channels and criminal marketplaces. Buyers can use them for fraud, extortion or further attacks.

You can stay away from a marketplace and still have something listed there.

I want to see how somebody else’s private information gets advertised to a buyer. What’s being offered, and how easy is it to find? First, I need to figure out how to get in.

Getting through the front door

The Tor Project’s website is cheerfully purple. I’m looking for the entrance to the dark web, and instead I’m slapped across the face with a lime-green download button. This is supposed to be the entrance?

I click “Get it for Desktop,” download the browser and open it. The app bounces and bounces in the dock at the bottom of my Mac’s screen. While I wait, I’m a little nervous. My heart races.

Then a browser window opens. Tor Browser is built on Firefox, which explains why the controls feel familiar. I know what to do with an address bar. I’m just less sure what I’m about to put in it.

There’s one more step: connect. A loading bar moves through shades of blue and purple while the browser connects to the Tor network. When it finishes, I’m looking at a DuckDuckGo search box.

Zooey Liao/CNET/Getty Images

I type “drugs.” An inspired start to my investigation.

To visit an onion site, I need an onion address. A standard one runs to 56 letters and numbers followed by “.onion.” Fortunately, some organizations publish theirs on their regular websites, and you can find them in certain subreddits. 

ProPublica includes its address in a guide explaining why it’s on Tor. I visit. It looks about as threatening as any other journalism website. ProPublica says its onion site gives readers greater privacy. There’s a reason for a newsroom to care about that beyond protecting its own reporters. Reading an investigation can be sensitive in itself, depending on who you are and who might be watching.

Newsrooms also use SecureDrop, a separate system that lets sources send documents and communicate with journalists through Tor, leaving less identifying information behind than ordinary email. Imagine having evidence of wrongdoing at work and wanting someone to investigate it while you still need to show up. Keeping your name out of that conversation seems reasonable.

Those privacy protections matter well beyond journalism. “Without Tor, political dissidents could be at risk of being identified by authoritarian governments, retaliated against, or physically harmed,” says Aaron Mackey, deputy legal director at the Electronic Frontier Foundation, a nonprofit that advocates for digital rights.

A banner on the ProPublica page directs me to the browser’s security settings, where I switch to “Safest.” Pages take longer to load than I’m used to.

I also try Ahmia, a search engine for onion sites, working through results and finding forums, pornography and pages that look like scams.

One site advertises drugs, guns, poison, driver’s licenses, documents, money and credit cards. It’s an ambitious inventory. I can read the description for each, but I can’t establish whether any of it actually exists or whether whoever takes the money intends to deliver.

Here, at least, is something that looks like the dark web I expected.

Other pages are harder to fit into that picture. One offers resources for anarchists, including material about avoiding police surveillance. I come across advice about protecting privacy alongside material about sabotaging surveillance equipment.

Then I find sites with listings claiming to offer credit-card information and Social Security information. Some advertise card data in bulk.

With drugs, I picture a buyer placing an order and waiting for a package. These listings make me think about somebody else: the person whose information is being offered. Someone who used that card to buy groceries or handed over a Social Security number to start a job. Now a stranger is advertising it to buyers who could drain an account or take out a loan in their name.

I can’t verify that the sellers have what they claim to have. But I can see who’s missing from the transaction they’re offering. The person whose information is for sale doesn’t get to set the price, approve the buyer or decide what happens next. They wouldn’t even need to know this website exists.

One man who bought stolen identities ended up in federal court.

In September, a federal judge sentenced Michael Calvin, a 45-year-old Missouri man, to more than four years in prison for using stolen identities to buy cars. According to the Justice Department, Calvin purchased people’s personal information and a driver’s license template on the dark web, created fake identification documents and used them to buy five vehicles worth roughly $333,000, including a Chevrolet Camaro, a Dodge Charger Hellcat and a Corvette.

This is what a stolen identity can look like once it leaves the marketplace: It’s not a mysterious hacker in a dark room, but someone using another person’s information to drive away in a $90,000 car. Calvin was ordered to pay $193,000 in restitution.

What the internet knows about me

I’ve spent hours looking at strangers’ information being advertised for sale. I’ve also seen what can happen when someone buys the real thing. Now I’m wondering about my own.

I’ve been giving websites my information for years, sometimes because I wanted to buy something, but often because a company required me to create an account before I could do anything.

SpyCloud, a cybersecurity service that searches collections of compromised information, associates my email address with several breaches. Among the results are Carhartt, Under Armour and OpenSea. I have accounts with all three, although I’ve never bought anything from two.

Apparently, creating an account was enough to leave something behind.

A six-page report that VanishID, a company that provides personal-data removal and monitoring services, prepared about me in September says my information appeared across 47 data-broker profiles, accounting for more than 3,400 individual data points. The company also identified my accounts in 92 known third-party breaches and reported finding 10 passwords exposed in readable form.

There are addresses where I’ve lived, details about my family and information linking my professional identity to my personal life.

And then there are the passwords. One of them dates back to high school. I was really into the punk band Bad Religion, and I was studying French, so I decided translating a song title into French would make for a good password. I liked it enough to keep using it. The report shows several variations, with changes I’d made over the years, presumably under the impression that adding a few characters or switching up the capitalization counted as better security.

I know better now. I didn’t then.

I’m not surprised to see any of this. I’ve spent years writing about data breaches, data collection and the ridiculous amount of information companies know about us. I would have been more surprised if the searches turned up nothing.

But there’s something gross about seeing it all laid out.

VanishID goes further, outlining ways someone could potentially use that information. Among the possibilities: pretending to be me as a journalist, imitating my writing style and trying to take over an old account.

Those aren’t attacks the company says have happened to me. They’re scenarios it constructed from the information it collected. VanishID also sells services to reduce that exposure, so I can’t treat its assessment as an independent security audit.

Which brings me to another question: Has this affected me?

I can’t point to a fraudulent purchase or a compromised account and definitively connect it to these breaches. But that doesn’t necessarily mean nothing has happened. Neither SpyCloud nor VanishID can tell me who has seen my information, whether someone has tried to use it or how many copies are floating around.

James E. Lee, president of the Identity Theft Resource Center, a nonprofit that helps victims of identity theft and fraud, explains that the risk depends on what was exposed. An old password that’s no longer in use might be relatively harmless. Other information, such as a Social Security number or driver’s license, can be combined with other details to create a fraudulent identity.

Someone could use pieces of my information without my ever finding out.

But just because my information appeared in a breach doesn’t mean it was advertised on a dark web marketplace. These records also circulate through ordinary websites, criminal forums and private exchanges.

What I can establish is that information associated with my accounts has ended up somewhere I never intended it to go. Some of the passwords have apparently been circulating for years.

Selling stolen information is one way to make money from it. Another is to threaten to publish it unless the organization it came from pays. The people whose records were taken don’t get a say in either transaction.

What they want you to pay for

A company can get its computers working again after a ransomware attack and still have a problem it can’t restore from a backup: Somebody else has its files.

The ransomware group Hive exploited that problem.

According to the Justice Department’s account of the operation, attackers stole sensitive information before encrypting a victim’s systems, making the files on those systems unusable. They then demanded payment for both the means to unlock them and a promise not to publish what they’d stolen. Organizations that didn’t pay could have their information posted on Hive’s leak site on the dark web.

That’s what investigators call double extortion. A backup might restore a company’s files, but it can’t retrieve copies that attackers have already stolen.

There was a business arrangement behind Hive’s threats, too. Administrators developed the ransomware, and affiliates used it to attack organizations. Successful ransom payments were split, with 80% going to the affiliates and 20% to the administrators, according to the Justice Department. The people writing the software didn’t have to be the people breaking in. Both could make money from the same attack.

And threatening to expose private information doesn’t require locking up anyone’s computers. The information itself can be enough.

In September 2020, Finnish psychotherapy provider Vastaamo received a demand for money accompanied by a threat to release its patients’ information. The following month, information appeared on the Tor network. Individual patients also received emails demanding payment to prevent their personal information from being exposed, according to Finland’s National Bureau of Investigation.

There’s no password reset that can make that information private again.

Finnish police warned that paying wouldn’t guarantee the information would remain secret. That leaves a brutal proposition: trust the person threatening to expose you to keep their word after they have your money.

This is where the distance I imagined at the beginning becomes difficult to maintain. The patients’ connection to the dark web ran through a psychotherapy provider. They had sought treatment. Someone else made their information part of an extortion attempt.

The ransom demand comes after the break-in. How the attacker got access can explain why people who did nothing wrong still end up exposed.

How your information ends up on the dark web

The 2023 breach at genetic testing company 23andMe began with stolen login details. An attacker took credentials exposed in earlier breaches and tried them against 23andMe accounts. Wherever someone had reused a password, there was a chance it would work again.

Security researchers call this “credential stuffing,” which is a fairly bloodless name for trying your keys in every door you can find.

Zooey Liao/CNET/Getty Images

That’s what makes these attacks so effective. Criminals don’t necessarily have to know who you are, or care.

“No one is trying to hack you individually. They’re hacking tens of thousands of people at the same time at scale,” says James Kettle, director of research at PortSwigger, a company that develops tools for testing website security.

Over five months, the attacker gained access to more than 18,000 accounts, according to a joint investigation by Canadian and UK privacy regulators. The company ultimately reported that nearly 7 million customers were affected. The company’s DNA Relatives feature let customers see information about people they are genetically related to. Breaking into one account could give the attacker access to thousands of other people’s details, including their names, locations and ancestry.

The possibility alone frightened some people. “The thought that information about my DNA and related potential medical conditions, predispositions and ethnicity could be floating around on the dark web scares the heck out of me,” wrote one commenter on Reddit in October 2023.

The regulators found failures in the company’s security controls and response. They also found that some breach notifications omitted something customers would presumably have wanted to know: that their information had been advertised for sale online.

Passwords can also be stolen directly from a computer. Malware known as an infostealer collects information from an infected device, including login credentials. The resulting collections, called logs, can be traded or searched for accounts worth pursuing.

Sometimes, all it takes is downloading what looks like legitimate software. Jaron Bradley, director of Jamf Threat Labs, leads a team researching malware that targets Macs. He says criminals have used convincing copies of legitimate websites, sometimes promoted through sponsored search results, to trick people into installing malicious software.

“People are getting infected by this, because they’re installing it themselves, because a website told them to,” Bradley tells me.

In June 2024, Google-owned security firm Mandiant documented a campaign targeting organizations using Snowflake, a cloud platform where businesses store and analyze data. In the cases it investigated, attackers used customer credentials that had been previously stolen by infostealer malware. Mandiant found no evidence that those intrusions resulted from a breach of Snowflake’s underlying enterprise environment.

The affected accounts lacked multifactor authentication, and some stolen credentials still worked years later. Attackers used them to enter customer databases, extract records and attempt to sell the information or extort the organizations.

There isn’t one route from theft to a dark-web listing. Europol describes stolen information moving through brokers, forums, encrypted channels and criminal marketplaces. Some gets repackaged and resold. Some provides access for another attack. Some becomes leverage in an extortion demand. Those transactions can happen across services on both the dark web and the ordinary internet.

A breach notification might tell you what a company lost. It can’t give you a complete list of everyone who now has your information, or what they plan to do with it.

Shopping for someone else’s life

On Genesis Market, buyers could search for stolen credentials by location and account type. Banking, email, social media. The sorting was convenient for people seeking access to somebody else’s accounts.

When authorities announced an operation against the marketplace in April 2023, the Justice Department said it had offered more than 80 million account credentials stolen from over 1.5 million compromised computers since its launch in 2018.

The merchandise went beyond usernames and passwords: Genesis also sold browser cookies and details about victims’ devices. Cookies help a website recognize an existing login; device information helps it assess whether a visitor looks familiar. Together with stolen credentials, that could help a buyer impersonate the account holder and evade fraud checks, according to the Justice Department.

Think about how much you appreciate a website remembering you. You don’t have to sign in again or convince it that, yes, this is still your laptop. Genesis sold information that could help someone else receive that welcome.

The Treasury Department documented one consequence: Hackers used a cookie purchased from Genesis to access a US company’s systems in June 2021 and steal sensitive material, including source code. Something taken from one device had helped expose a company’s intellectual property.

Individual buyers were shopping there, too. In a November 2023 sentencing announcement, federal prosecutors described how Laderian Odom of Monroeville, Alabama, bought approximately 950 sets of stolen login credentials using cryptocurrency. They included access details for bank accounts, Amazon and social media. He received a two-year prison sentence for illegally possessing the credentials.

Other marketplaces specialized in payment information. BidenCash charged a fee on transactions involving stolen cards and associated personal details, according to the Justice Department. When US authorities announced the seizure of roughly 145 associated domains in June 2025, they said the marketplace had generated more than $17 million in revenue.

It also ran promotions. Between October 2022 and February 2023, BidenCash released 3.3 million stolen card records for free to attract business, prosecutors said. The exposed information included card numbers, security codes and account holders’ contact details. Someone’s stolen financial information was being used as a free sample.

In September 2026, a service called Nexus was advertising access to more than 153 million scans of driver’s licenses from the US and Canada. Cybersecurity journalist Brian Krebs discovered that his own license was among the records being offered. The FBI began investigating, and identity verification company IDScan.net subsequently confirmed a breach of its cloud systems.

The number of people affected remains unclear. One person might have their license scanned repeatedly by different businesses, creating multiple records. But unlike a password, a driver’s license contains details that can’t simply be changed, and copies can potentially be used to create fraudulent identification documents.

And some of these businesses don’t bother hiding behind an onion address.

In March 2026, an international law enforcement operation shut down LeakBase, a forum where criminals bought and sold stolen information. According to the Justice Department, the site had more than 142,000 members and over 215,000 messages. Its inventory included hacked databases, banking details, credit card information and account credentials.

LeakBase was accessible on the ordinary web. You didn’t need Tor Browser or a special network connection to reach it.

There’s something almost disappointing about that. After all the elaborate imagery surrounding the dark web, one of the largest criminal marketplaces for stolen information was operating on the same internet the rest of us use every day.

Genesis and BidenCash also operated across both the ordinary web and the darknet. For these businesses, the storefront mattered less than finding customers.

Criminals also use social media and messaging platforms to advertise fraudulent documents, stolen information and instructions for committing fraud.

Lee says some of that activity has reached YouTube and TikTok, where sellers can attract people who wouldn’t know how to find a darknet marketplace in the first place. The listings can disappear after being reported, only to return under different accounts or names.

The line between the criminal underground and the internet the rest of us use is becoming harder to draw.

Finding buyers comes with risks of its own.

Jennings, the ZeroFox exec, describes the dilemma from the criminal’s perspective: “It’s this balancing act of making sure that enough people are out there who could potentially buy my wares, but also not drawing a ton of attention to yourself.”

What the buyer intends to do determines what they need. Stolen card details might support fraudulent purchases. A working corporate login could give an attacker a starting point inside a business. Europol describes brokers selling access alongside stolen datasets, with customers able to buy services and instructions for carrying out further crimes.

The person who steals a password doesn’t have to be the person who uses it. Some criminals specialize in breaking into organizations, establishing access to their systems and then selling that access to others who eventually attack it.

“In those situations, sometimes they’ve had access for months before somebody actually uses it to perform a campaign,” says Mark Thornberry, senior vice president at cybersecurity company GuidePoint Security.

Privacy is harder than it looks

After reading about businesses this organized, I’m starting to assume the people running them have also figured out how to keep their own names out of the paperwork. Then I come across a detail in the AlphaBay investigation: a personal Hotmail address.

According to court documents summarizing the government’s allegations, early welcome emails from the marketplace’s forums included an administrator’s personal email address in their header information — the technical details attached to a message. Password recovery emails included it, too. Investigators linked that address to Alexandre Cazes, the Canadian man accused of running the marketplace. Financial records and other evidence helped build the case against him.

An operation built around concealed identities had been sending out a clue with its welcome messages.

When authorities arrested Cazes in Thailand in July 2017, they found his laptop open and logged into AlphaBay as an administrator, according to the same court record. Files on the computer contained passwords for the marketplace’s servers. The investigation reached someone sitting at an actual computer, with accounts open and evidence on the machine.

Zooey Liao/CNET/Getty Images

That helps me understand a distinction I’d been overlooking: Tor can conceal the network address, but it can’t stop someone from putting identifying information into an email.

The same limit applies to considerably less dramatic things I do. If I open Tor Browser and sign into my usual email account, the email provider knows which account I’m using. Tor can still protect my connection and hide my IP address from the provider. It doesn’t make the provider forget whose inbox it is.

Tor’s safety instructions also warn about downloaded documents. Open one in an outside application while connected to the internet, and it may fetch something without going through Tor, potentially revealing your IP address. The browser’s protections don’t automatically extend to every program on the computer.

I understand that mistake a lot more easily than I understand the encryption. Download a file. Open it. Exactly what I’ve done a thousand times without thinking about which application is making which connection.

And the criminals’ own systems can be compromised. Months before the Hive disruption became public, the FBI had penetrated its network and obtained decryption keys. Agents supplied keys to victims, helping them recover their files without paying the demanded ransoms, according to the Justice Department.

These cases make the people running the operations seem more fallible. They offer less comfort to everyone whose information passed through their hands.

Law enforcement can shut down criminal marketplaces, seize servers and remove stolen information from platforms they’ve taken over. But the FBI acknowledges there’s a limit to what investigators can undo. Copies that have already been sold or shared can remain in circulation.

You can close an account, change a password or stop using a service, but you can’t make everyone who has your information cooperate.

How to find out what’s been exposed

You don’t have to venture into the dark web yourself to find out whether your information has been compromised. In fact, you’re probably better off starting somewhere considerably less suspicious.

Have I Been Pwned lets you enter an email address to see whether it appears in known data breaches. It identifies the companies involved, when the breaches happened and what types of information were exposed. Its personal dashboard can also show certain records captured by infostealer malware.

Try checking old email addresses, too. An account you haven’t used in a decade might still be connected to information that’s circulating today.

Other services, such as Coveron, offer ongoing monitoring and alerts when they detect compromised personal information. That’s useful because a breach might not become public until months or even years after the information was stolen.

There’s a catch, though. None of these services can search every criminal marketplace, private forum or database. A clean result doesn’t mean your information hasn’t been exposed. And finding a match doesn’t necessarily mean someone is selling your identity on the dark web, or that anyone has used your information against you.

What these services can tell you is where some of your information has surfaced. What they can’t tell you is everywhere it might have gone since.

What you can still control

I’d love for this part to involve a button that pulls my information out of circulation. Instead, some company loses your data, and you get homework.

Preventing a company from losing information you’ve already handed over may be impossible. But you can make that information harder to exploit.

“It is a matter of making your data less useful,” Lee says.

Criminals increasingly rely on automated attacks, where speed and efficiency matter. A stolen password that no longer works or a credit file that can’t easily be used to open a new account creates another obstacle for someone trying to make money from your information.

What you do next depends on what was exposed. An old email address, a working password and a Social Security number call for different responses. If you receive a breach notice, read it carefully. You want to know what information was taken, not just which company lost it.

If a password was exposed, change it on that account and anywhere else you reused it.

For accounts that use passwords, give each one its own. A password manager can generate and remember them, sparing you the job of inventing 80 variations on your cat’s name. A password stolen from one service shouldn’t also open your email, shopping accounts and everything else. CISA, the federal cybersecurity agency, recommends long, random, unique passwords and a password manager to handle them.

Turn on multifactor authentication wherever it’s available so a stolen password alone is less likely to let someone into your account. Where a service offers passkeys, consider setting one up. They replace the password with a sign-in method designed to resist phishing, including attempts to trick you with a fake login page.

If you’re worried about someone opening credit accounts in your name, freeze your credit with all three major bureaus: Equifax, Experian and TransUnion. It’s free, doesn’t lower your credit score and can be temporarily lifted when you need to apply for credit. You don’t have to wait for a breach to do it.

Keep watching existing accounts, too. Report unfamiliar charges promptly to the issuer, using its official app or the number on your card. If someone misuses your identity, the FTC’s IdentityTheft.gov provides a recovery plan based on what happened.

You can also restrict access to certain reports used to open other kinds of accounts. ChexSystems offers security freezes on consumer reports used by some banks, while the National Consumer Telecom & Utilities Exchange offers freezes for certain reports used by phone and utility companies. These are separate from credit freezes and won’t prevent every fraudulent account from being opened.

None of this excuses the organizations holding the information. Mackey, of the EFF, argues that we need to “go upstream and stop the non-consensual collection of private information in the first place.”

A better password won’t repair a company’s poorly secured database. And you can’t always refuse to provide information that a doctor, employer or bank requires.

And even when people discover that someone has used their information, putting things right can be far more complicated than changing a password.

The Identity Theft Resource Center examined more than 6,000 people who contacted the organization between April 2025 and March 2026. Among victims who reported experiencing financial harm, only 9% said their cases had been resolved.

The findings reflect people who contacted the organization for help, not identity theft victims nationwide.

A fraudulent account can be closed. A bank can investigate an unauthorized transaction. Those things take time, and resolving one problem doesn’t necessarily mean every other copy of your information has disappeared.

None of that makes these precautions pointless. They can’t retrieve the stolen files, but they can make the information inside them harder to exploit.

Somewhere far away

The room from the beginning still works. Rain on the window. A face washed out by a monitor. Somebody eating over a keyboard they should probably clean.

I just don’t think it explains very much anymore.

Outside that frame are the people who wrote the software, stole the credentials, bought the access and decided what to do with it. There’s a company trying to get its systems running. A patient wondering who’s read something they told a therapist. Someone opening a breach notice at the kitchen counter, trying to remember when they even became a customer.

The dark web gives some of those transactions a place to happen. The technology behind it also gives people ways to communicate without exposing themselves. 

Ross Kinder, chief technology officer at identity verification company Nametag, sees part of the problem beginning long before anyone steals anything.

Consider showing your ID to get into a bar. The bouncer needs to know you’re old enough to drink. They don’t need to know where you live, but you’ve handed them that information anyway.

“We have to hand over way more personal data than is actually necessary for the transaction,” Kinder says.

It’s such an ordinary exchange that we rarely think about what happens to that information afterward, or whose responsibility it becomes.

What stays with me is how little of the harm requires anything exotic from the person on the receiving end. You make an appointment. Start a job. Open an account. Someone asks for information, usually for a reason that makes sense, and you hand it over because you need to get on with your day.

I still want to know who’s behind the screen. But I’m paying more attention to the records on it, and to the ordinary circumstances that put them there.

The kitchen in the opening feels different now. I can carry my plate over, check tomorrow’s weather and leave the laptop closed for the night.

But that won’t close anybody else’s.

---

---

Visual Designer | Zooey Liao

Art Director | Jeffrey Hazelwood

Creative Director | Viva Tung

Video written, hosted, filmed and edited by | Owen Poole

Project Manager | Danielle Ramirez

Editor | Corinne Reichert  

Director of Content | Jonathan Skillings