A small business owner had no idea their company credentials, client data, and internal emails had been available for purchase on the dark web for over eight months. This is their story.
Marcus, the owner of Northgate Electrical Services, reached out to us for a routine cybersecurity consultation. His business had been running smoothly for six years — no obvious breaches, no ransomware, no complaints from clients. He assumed his business was secure.
During our initial assessment we performed a dark web scan using his business domain and employee email addresses. What we found stopped the conversation entirely. Northgate's data had been actively listed on several dark web marketplaces for the better part of a year — and Marcus had absolutely no idea.
The breach originated from a phishing email received by a junior employee eight months earlier. The employee clicked a link in what appeared to be a software renewal notice and entered their login credentials on a fake page. Those credentials gave the attacker access to the company email account.
From that single entry point the attacker moved laterally through connected systems — accessing the project management platform, the accounting software, and eventually the website backend. All of this happened silently, over weeks, with no alerts triggered because there were no monitoring systems in place.
The attacker then packaged the collected data and listed it for sale on a dark web marketplace. By the time we discovered it, the listing had been viewed hundreds of times.
We offer a free dark web scan for your business domain and employee emails. Find out in minutes what attackers already know about your company.