Dark web monitoring and leaked credentials

Through a sweep that matches your domains against the places where stolen credentials are sold and published: dark web marketplaces and forums, cybercrime channels, breaches and infostealer logs. The initial sweep, the first piece of work under the contract, shows what is already exposed. From then on, the monthly review picks up anything new.

Hard2bit, a Madrid-based cybersecurity company certified to ENS High category (ENS_2.026.061) and ISO 27001, offers dark web monitoring as an annual service for organisations across Spain and Europe, including subsidiaries of international groups. It reviews dark web marketplaces and forums, cybercrime channels, breaches and open sources every month, and its reports serve as evidence for NIS2, DORA, ENS and ISO 27001.

Yes. Reports, finding profiles and the leadership summary can be delivered in English or Spanish, so the local team and group security can work from the same document. Scope can cover the subsidiary's own domains and brands, and meetings can be held in English.

Hard2bit is certified to ENS High category, the most demanding level of Spain's National Security Framework (certificate ENS_2.026.061, issued by ACCM and valid until 2028). Each client's findings are handled within that certified system, which makes it easier to fold the service into your own ENS compliance.

Article 13(1) of DORA requires financial entities to gather information on vulnerabilities and cyber threats. Dark web monitoring provides part of that information: credentials belonging to staff and ICT providers, access for sale and mentions of the entity, with a monthly report. Hard2bit delivers it from Madrid and ties it in with its DORA compliance service.

By including that supplier and your own domains in scope: we look for credentials, access and documents of yours that came out of the breach and assess whether they're likely to still be valid. Verizon's 2026 DBIR reports that breaches involving a third party rose by 60% and now make up 48% of the total. Third-party risk management covers the rest.

Ransomware groups publish the data of victims who don't pay on their leak sites, and that data then spreads to forums and sales channels. We watch those sources to establish what has been published and what is circulating, with a monthly report. If you also need to contain the incident, our incident response retainer handles that side.

Have I Been Pwned and similar services show whether an address appears in known, already published leaks. Monitoring also covers dark web marketplaces and forums and cybercrime channels, where recent credentials and access are sold. It repeats every month, spans domains, brands, executives and suppliers, and checks every finding before it's delivered.

Entra ID Protection flags leaked credentials for accounts in your tenant when Microsoft finds them. It doesn't cover access for sale, brand impersonation, exposed documents, or the credentials of your suppliers and of services outside Microsoft. The two complement each other, and the tenant side is covered by our Microsoft 365 security service.

We check who it belongs to, which system it opens and whether it's likely to still be valid, and include it in the report with the recommended action: usually changing the password, revoking active sessions and reviewing the access. Where Hard2bit runs your SOC or incident response, rotation and containment are coordinated from there.

It provides evidence for a control. ISO 27001:2022 covers threat intelligence in Annex A control 5.7; the NIS2 Directive requires incident handling and supply chain security measures under Article 21(2), and DORA requires financial entities to gather information on vulnerabilities and cyber threats under Article 13(1). If we work with you on ISO 27001, ENS, NIS2 or DORA, the reports feed straight into that evidence.

That depends on the controller's assessment. Article 33 of the GDPR requires a personal data breach to be notified to the supervisory authority (in Spain, the AEPD) within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to individuals. The finding profile gives the date, scope and type of data for that assessment, which belongs to the controller and its data protection officer.

Compare six things: whether it covers the dark web and cybercrime channels or only published breaches; whether it checks findings before delivering them; how often it reviews; whether scope includes executives and suppliers; whether findings are handled within a certified system such as ENS or ISO 27001; and whether it can act on them through a SOC or incident response service.

Dark web monitoring looks for your organisation's credentials, access and information that have already leaked or are for sale. Threat intelligence analyses the actors, campaigns and trends targeting your sector, and is where early warning belongs. Digital risk protection is the market's name for the wider set of services that watch a company's external exposure, including the dark web and brand impersonation. This service can be taken on its own or as part of the threat intelligence programme.

It's an annual contract with a monthly review, which can move to more intensive monitoring if you need it. It's sized by the domains, brands, executives and suppliers included. After the scoping meeting we send the proposal, and the initial sweep is the first piece of work under the contract. Reports are available in English or Spanish.