Dark Web Surveillance for Private Clients

Your passwords, phone number, and personal information may already be circulating on the dark web. Criminals use this data to target individuals, families, and businesses. This article explains what dark web monitoring can and cannot do.

The numbers are through the roof

Cybercrime in the United States has grown every year. In 2025 the FBI’s Internet Crime Complaint Center received 1,008,597 complaints with $20.877 billion in reported losses, a 26 percent increase over 2024 [1]. That is nearly 3,000 complaints every day [2].

Impersonation is a large part of it. Government impersonation alone drew 32,424 complaints and nearly $798 million in losses, and identity theft drew 31,675 complaints [1]. Criminals pretending to be bank support staff stole another $359.7 million through account takeovers [1].

Artificial intelligence is making it worse. The FBI logged 22,364 complaints involving AI in 2025, with losses near $893 million, including voice clones and fake videos of loved ones [2].

Where your information ends up

The dark web is a set of websites that ordinary browsers and search engines do not reach. Criminals use it to buy and sell what they steal. The inventory is personal.

In March 2026 the Justice Department and 14 countries shut down LeakBase, a forum with more than 142,000 members and “hundreds of millions of account credentials,” including bank account numbers, passwords and personal data of U.S. individuals [3].

A year earlier, the Cracked and Nulled marketplaces were seized after affecting at least 17 million U.S. victims; one product sold there searched “billions of leaked websites” for a person’s login details [4].

These markets get rebuilt. LeakBase followed RaidForums and BreachForums, each taken down in turn [3]. Your data does not disappear when one site does.

Who gets targeted

In our experience, high-net-worth individuals and founders are chosen on purpose. Their names appear in press releases, funding announcements and property records.

Their email addresses and phone numbers appear in breach files.

The attacks that follow are personal. Someone impersonates the founder to a bank or an assistant, or takes over a phone number, then an email account, then a brokerage login.

The family often discovers the breach only after the money is gone.

What dark web surveillance actually does

Monitoring means watching criminal forums, paste sites and marketplaces for a client’s names, emails, phone numbers, domains and account identifiers.

When something appears, we know before it is used. That is the pre-emptive side.

The post-incident side matters just as much. After a compromise, monitoring shows what was taken, where it is being sold and whether the attack is continuing.

It also exposes impersonation accounts and fake websites, which we work to shut down with the platforms and hosting companies.

Dilendorf Law Firm does this with retired law enforcement cybercrime specialists. They have run these investigations for the government. Now they run them for our clients.

Finding the people behind it

Depending on the facts, a client may ask us to identify the attackers. That is a legal process as much as a technical one.

We send subpoenas to web hosts, domain registrars, email providers and any other company we can tie to the bad actors.

The returns include IP addresses and connection logs. Attackers hide behind VPNs, but from our experience a VPN connection sometimes drops during an attack and the real address is logged.

More than once, that address was in the United States.

That matters because U.S. law enforcement has jurisdiction there. A Michigan man who bought 2,468 stolen credentials on a dark web market was sentenced to 60 months in federal prison [5], and a Virginia man who co-ran a market selling stolen credentials and identity data received 40 years [6].

When our investigation identifies a person, we refer the case to federal or state prosecutors.

Never pay to make it stop

Victims are often told that paying will end the attack. Do not do it. The U.S. government “strongly discourages all private companies and citizens from paying ransom or extortion demands” [7].

The reason is legal, not just practical. Many attackers are sanctioned persons, and OFAC “may impose civil penalties for sanctions violations based on strict liability,” meaning you can be liable even if you did not know who you paid [7].

License requests to pay are reviewed “with a presumption of denial” [7].

If a ransomware payment is ever considered, it has to be done lawfully.

FinCEN has warned that firms which take a victim’s money, convert it to cryptocurrency and send it to criminals may be money transmitters that must register and comply with anti-money-laundering rules [8].

That means a licensed, registered provider, a sanctions check, negotiators with law enforcement backgrounds, and prompt reporting to the FBI or CISA, which OFAC treats as “a significant mitigating factor” [7].

When a phone or home network is compromised

Most attacks on private clients start with a device. We have handled investigations involving compromised iPhones, SIM cards, iCloud accounts and hacked home Wi-Fi networks.

The question is always the same: how did they get in.

Digital forensics answers it. We examine the phone, the computers and the network, trace IP addresses and VPN connections, and review compromised email accounts.

Ransomware is sometimes part of the same puzzle.

The result is a root cause, a closed door and a record. That record supports an insurance claim, a claim against a negligent carrier or platform, and a referral to law enforcement.

The FBI asks victims to file at ic3.gov with names, contact methods, dates and payment details [2].

This article is for general informational purposes only and does not constitute legal advice. Investigations and outcomes depend on the facts of each matter and no result is guaranteed. Reading it does not create an attorney-client relationship with Dilendorf Law Firm. Prior results do not guarantee a similar outcome. Attorney Advertising.