Can Your Data Be Removed from the Dark Web? What to Do Instead
If you have had an email saying your details were found on the dark web, or a company has told you your information was caught up in a data breach, the first question is usually: can it be deleted? The honest answer is almost always no. Once stolen data has been copied and shared, there is no central place to remove it from.
That does not mean you are powerless. What matters is making the stolen information useless to criminals. This guide explains what “on the dark web” really means, why removal is not realistic, and the practical steps that protect you and your business.
What does “on the dark web” actually mean?
The dark web is a part of the internet that needs special software to reach and is not indexed by normal search engines. Criminal marketplaces and forums there trade stolen logins, identity documents and customer databases.
When a business is breached, the stolen data may be sold, leaked to pressure the business into paying a ransom, or bundled with data from other breaches. Australians saw this in November 2022, when data stolen from Medibank customers was published on the dark web.
The information most often traded includes:
- Email addresses and passwords from breached websites.
- Names, dates of birth, addresses and phone numbers.
- Driver licence, passport and Medicare details.
- Logins captured by malware on infected computers.
Why the data cannot be removed
- It is copied quickly. A leaked file can be downloaded and reshared many times within hours.
- The sites ignore takedown requests. They are run by criminals who operate outside any legal process.
- Copies live offline. Once someone has downloaded the data, it sits on their own devices.
Be wary of any service that promises to “remove” your data from the dark web. Monitoring services can tell you where your details appear, which is useful. Deletion is a different promise, and not one anyone can genuinely keep.
What to do if your details are exposed
Focus on the things you control: passwords, sign-ins, identity documents and your credit file.
1. Find out what was exposed
The Australian Signals Directorate (ASD) suggests checking your email address at Have I Been Pwned, which lists known breaches, and using the “Have you been hacked?” tool on cyber.gov.au to work out what to do next.
2. Change passwords, starting with email
Change the password on the breached account and on any other account that used the same password. Your email account matters most, because it is used to reset everything else. Use a long, unique passphrase for each account and store them in a password manager. Our guide to strong passwords and authentication explains how.
3. Turn on multi-factor authentication
Multi-factor authentication (MFA) means a stolen password alone is not enough to get in. Switch it on for email, banking, Microsoft 365 or Google, and any account holding money or personal information.
4. Protect your identity
- If identity documents were exposed, contact IDCARE, Australia and New Zealand’s national identity and cyber support service, on 1800 595 160. They can help you work out which documents to replace.
- Consider a free credit ban. You can ask Equifax, Experian or illion to ban access to your credit report for 21 days, and the ban can be extended if you remain at risk.
- Tell your bank if any financial details were involved.
5. Report it
If you have lost money or an account has been taken over, report it through ReportCyber at cyber.gov.au. Scams can be reported to Scamwatch.
What it means for your business
When staff use their work email to sign up to other websites, a breach of those sites can expose your business. Criminals test leaked passwords against Microsoft 365 and other business systems, hoping someone reused one.
- Enforce MFA for every staff account. Our small business guide to MFA shows how.
- Ban password reuse between work and personal accounts.
- Monitor for your company domain appearing in new breaches, and reset affected accounts quickly.
- After any suspected compromise, check mailboxes for forwarding rules or unknown sign-ins.
If your business is covered by the Privacy Act and customer data is stolen from you, the Notifiable Data Breaches scheme requires you to take reasonable steps to assess a suspected breach within 30 days and, where serious harm is likely, notify the people affected and the OAIC.
Quick checklist
- Check Have I Been Pwned for your email addresses.
- Change reused passwords, starting with email.
- Turn on MFA everywhere it is offered.
- Contact IDCARE if identity documents were exposed.
- Consider a free credit ban.
- Report losses through ReportCyber.
Our managed IT security service helps businesses put these protections in place and keep them running, with 24/7 monitoring for suspicious activity.
Worried your business logins are already exposed?
Our free IT Health Check reviews your sign-in security and MFA coverage, and shows which accounts need attention first.
Or call 1300 133 770.
