Dark Web Monitoring in Avast Secure Identity – FAQs

The surface web comprises websites indexed (or cataloged) by search engines. The dark web is a hidden layer of the internet that is not indexed by search engines and requires specific software to access.

The dark web is popular with criminals because they can remain anonymous and difficult to trace while communicating. It is often used as a marketplace where hackers and thieves exchange information, goods, and services. Information exposed through data breaches, hacking incidents, or data leaks can be bought and sold on the dark web as “lists” by identity thieves.

Information on the dark web may be old or can reappear months or even years after it was originally exposed. The dark web forms a small part of the larger deep web.

The dark web can only be accessed by downloading special open‑source browser software. Such software typically uses encryption technology to help users maintain their anonymity online. It does this, in part, by routing connections through servers around the world, making them much harder to track.

You do not need to visit the dark web for your information to appear there. Information exposed through data breaches, hacking incidents, or data leaks can be bought and sold on the dark web as "lists" by identity thieves. This information may be old or can reappear months or even years after it was originally exposed.

Here are some ways in which your data can be collected and later sold on the dark web:

• Passive digital footprint: Your IP address, the websites you visit, the browsers you use, and other activity. Cybercriminals can collect data that you leave behind when using the internet.
• Active digital footprint: The data you share online, including pictures, videos, messages, blogs, interactions, and purchases that may include personal details such as your address or phone number.
• Information disclosed by other entities: Organizations such as government agencies, financial institutions, and data brokers collect information about you, which may later be shared or exposed.

"Exposed" information does not necessarily mean that your account(s) have been hacked. However, it indicates that your data may be at risk. To help protect yourself, change the password for the affected account, and update any other accounts that use the same password. Additionally, enable two‑factor authentication whenever it is available.

Even if you have unsubscribed from a website or deactivated your account, your data may still be stored in the service’s systems and could be exposed in a data breach, hacking incident, or other type of data leak.

Cybercriminals use dark web marketplaces and forums to exchange illegal products and services. The types of data that may be traded include:

• Personal data: Names, addresses, email addresses, and dates of birth. This information can be used for identity theft.
• Financial data: Credit card details, account credentials, and other financial information.
• Medical data: Medical history, test results, billing details, and other sensitive records.
• Confidential data: Property information, intellectual property, and other sensitive personal or business data.
• Online account data: Credentials or access to online and social media accounts, which may be targeted if not properly secured.
• Forged documents: Fake identification documents, such as passports and driver’s licenses.

As part of the Dark Web Monitoring service, Avast scans the surface web, deep web, and dark web for exposed information. When you subscribe, it defaults to monitoring your email address, and a one-time historical dark web scan is run (going back to 2008) to determine if the information you provided has previously been exposed. If exposed information is found, Avast will notify you. Continuous scans are then performed to detect newly exposed information. If your information has been exposed, you can take actions to help protect yourself.

Avast does not and cannot erase information from the dark web due to the highly anonymous nature of forums, communities, and marketplaces where such data is shared.

Through ongoing scanning processes, Dark Web Monitoring notifies you when information that may belong to you is detected on the dark web.

Your Dark Web Monitoring notification displays two types of exposed information. When you enroll, you provide information that is actively monitored. If this information is detected on the dark web, it is displayed in the Exposed Information section.

If other exposed information that may be related to you is detected, you are also notified. Even if you did not provide this specific information, it may be possible to use the information you did provide to identify other related data. Since this additional information was not directly provided by you, only limited details may be shown.

For example, in the case of a healthcare database breach, if you have provided insurance-related information for monitoring, additional exposed data may include items such as blood type, prescription medications, diagnoses, and related details. This type of information is displayed in the Additional Exposed Information section.

Avast does not pay for or purchase personal information on the dark web, private forums, or through any other means.

Any data you provide is encrypted, and access to sensitive personal information is limited to authorized employees who are trained in handling such data. These employees must use unique credentials each time they access personal information and are subject to monitoring by Avast information security systems.

Personal information is stored and managed in secure, encrypted systems.

The dark web is constantly changing, so no service can guarantee complete coverage of all dark web and private sources. Dark Web Monitoring scans a wide range of sources, including the surface web, deep web, and dark web.

There could be several reasons why you may not recognize the website mentioned in a notification. Here are a few possible explanations:

• The account may have been created using a Facebook or Google login. Some accounts may be old, and you may not remember using the website or service.
• You may have provided login details (username and password) for one-time use and did not return to the website afterward.
• In some cases, breached websites or services may deactivate exposed accounts, making them difficult to recognize.

Even if you do not recognize the password shown in the alert, it is recommended to change the password associated with the affected website and any other accounts where the same password was used.

For some alerts, confirmation is required to determine whether an activity or transaction is legitimate and whether there may be a risk of identity theft. For other notifications, such as Dark Web Monitoring alerts, Avast informs you that information that may belong to you has been detected. These notifications do not require confirmation because they are based on scan results, not user activity.