What to do if my username is found on the dark web?

Reviewed by Mike Marcacci, Sr. VP of Engineering at OmniWatch

What is the Dark Web?

The dark web is a part of the internet that can only be accessed using special software, such as The Onion Router (TOR). It is an anonymous network where users can communicate and access websites without fear of being tracked or identified. Many people use the dark web to buy and sell illegal goods, as well as engage in other criminal activities.

The dark web also has legitimate uses such as allowing whistleblowers to communicate securely with journalists or activists to share information without fear of government surveillance. Some individuals may also use the dark web for more mundane tasks like browsing online forums or playing video games. Regardless of its purpose, it remains largely unregulated and often serves as a hub for illegal activities.

How did my Username end up on the Dark Web?

There are several ways a username can end up on the dark web. One way is through an online data breach, where hackers gain access to a company’s database and steal personal information like usernames and passwords as well as other sensitive data. Another way for a username to be exposed is if someone with malicious intent deliberately posts it on the dark web. In some cases a username can also be exposed due to human error or negligence. For example, if an employee accidentally uploads a file containing sensitive information to a shared server that is not properly secured.

What can Someone Do With Your Username?

While a leaked username alone may not directly grant a hacker access to your sensitive information, it can serve as a piece of the puzzle that facilitates a security breach. Here's what someone might potentially do if they have your username:

• Attempt Unauthorized Logins: If the person also knows (or guesses) your password, they could log into your accounts to steal information or impersonate you.
• Cross-Referencing Breach Data: Often, malicious actors will use a username to cross-reference known breaches where additional information associated with your username can be gleaned to increase their likelihood of success. For instance, if an account you own with the same username was breached on another site, along with your email and a password - the attacker now has a strong foothold from which to begin guessing your current password or pivot to attacking your email account.
• Brute Force Attacks: A username could be used to attempt to guess your password through a brute force attack, trying thousands or even millions of password combinations. Hackers will start with the first 1 million most commonly used passwords if they have no intelligence narrowing that field.
• Spear Phishing: If a hacker knows your username, especially if it's similar to your real name or connected to your personal email, they could craft convincing phishing attempts that look like they're from a service you use. These phishing attempts may try to get you to reveal your password, financial information, or other personal details.
• Social Engineering: With your username, hackers can use social engineering techniques to trick customer service agents or even your friends and family into revealing more information about you or resetting your password.
• Identity Theft: If your username is close to your real name, it could potentially be used as part of broader attempts to steal your identity.

Remember, while having your username leaked isn't ideal, it's far from a worst-case scenario. Your response to such an event determines the ultimate impact. Be proactive with your digital security and take these steps:

• Use an incredibly strong passPHRASE (20+ characters, all character sets–usually a sentence that includes special characters and numbers). Use this passphrase as your master password for a password manager.
• Recent data has demonstrated that regular password rotation actually results in people using easier-to-guess permutations of the same general password. Using a very strong passphrase to protect a password manager that assigns random passwords to each login is probably the safest route. That passphrase needs to be different from ANYTHING you've ever used.
• Use unique credentials for each site.
• Enable two-factor authentication wherever possible.
• Give fake answers to password reset questions and store them in your password manager. The answers to these questions are often easy to research.

How to Protect Yourself From Identity Theft

Once you have identified that your username has been compromised, there are a few immediate steps you should take.

• Change your password on the affected account. Even if it seems that only your username has been exposed, a leak might be more extensive than initially reported.
• Create a strong password using a combination of letters, numbers, and special characters.
• Enable multi-factor authentication if it's available. This adds an extra layer of security to your account.
• Consider adopting a password manager to manage all your credentials and store MFA token inside it. 1Password® offers this and more functionality.

Change Usernames of any Accounts Using the Leaked Username

If you're like most people, you probably use the same or similar usernames across multiple platforms. This is a risky practice, as a leak from one platform can potentially expose your accounts on others. It also allows people to match small bits of information from various accounts to build a more complete profile of who you are.

Use Unique Usernames for all Future Accounts

To avoid finding yourself in this situation again, use unique usernames and passwords for different platforms. Password managers can help manage this task without the need for you to remember all your login details. Remember to use an incredibly strong passPHRASE (20+ characters, all character sets...usually a sentence that includes special characters and numbers) as the master password for your password manager.

Sign up for an Identity Protection Service like OmniWatch™

Identity protection services like OmniWatch can monitor your credit, help detect suspicious activity, and offer identity theft insurance if your identity is stolen.

To learn more about how OmniWatch identity theft monitoring can help you know if your username is found on the dark web or other personal data is compromised, click here.  

What Cybersecurity Professionals are Saying

Chester Wisniewski

Principal Research Scientist at Sophos

“Looking forward into 2023 has me very concerned with what developments we see with the malicious use of machine learning technologies”

Matt Kapko

Cybersecurity Reporter

"Threat actors don’t just follow the news — they react to it and identify new ways to target potential victims during moments of heightened sensitivity."

Chester Wisniewski

Principal Research Scientist at Sophos

"ChatGPT3 could easily be weaponized to help criminals write more convincing phishing and business email compromise scams."