We found our personal data on the dark web. Is yours there, too?

By Dan Patterson, Graham Kates

/ CBS News

Exploring the dark web

The little drips of personal data leaked from every major data breach—your name, email, phone number, Social Security number, and mailing address—pool in a murky corner of the internet known as the dark web. Some of these leaks might seem relatively insignificant, but criminals exploit your personal data for profit and to help other criminal operations prosper. The dark web is where these transactions happen.

The spectrum of threat actors operating on the dark web is broad, ranging from lone wolf hacktivists to nation-states and organized criminal operations. What they have in common, however, is a lust for personal data. The recent Gnosticplayers hack, for example, obtained nearly 840 million records from 32 companies. And according to cybersecurity experts, while unique records sell for cheap—a portion of the trove was listed for 1.2431 bitcoin, or about $4,940—in aggregate our personal details help enrich these nefarious operators.

Navigating the dark web

Like the traditional internet that we use every day, the dark web is a network of websites. But unlike our traditional internet, the dark web requires special security software to encrypt browsing activity and hide a user's location and identifiable details.

There are countless legitimate uses for the dark web. Political activists living in totalitarian states use the encrypted web to share mission-critical information, and reporters in conflict regions often use the dark web to communicate with sources. But the dark web's discreet nature is also exploited by hackers and criminals to trade in weapons, drugs, stolen data, and other illicit goods and services.

Modern dark web data markets often require login credentials to access illicit goods and services.

Hacked personal data may seem benign relative to other harmful material for sale on the dark web, but according to Emily Wilson, the vice president of research at cybersecurity firm Terbium Labs, in the hands of criminal actors your personal data can have serious and potentially dangerous consequences.

"Data is transmitted very quickly. There's no ship time. Criminals buy it, they get it instantly, and they can cash it out," said Wilson. "Data is often good for a long time. If somebody uses your credit card, you get a fraud alert, and get a new credit card number. That's a loss to you and that's annoying. But what about your Social [Security number], what about your name, what about your address or your driver's license numbers? These are data points that can be exploited for decades or for a lifetime. And once it's out it's nearly impossible to get it back."

dark-web-pricing.png
One dark web data site sold our information along with several thousand other individuals for less than $100 in Bitcoin.

We asked Terbium Labs to do a deep dive into the dark web and search for any information about us that had been leaked as a result of hack. What they found was disturbing. Our personal information was mixed in with wholesale data dumps of information about thousands of people. The building blocks to not only replicate our own identities online, but everyone else packaged along with us.

"Identity theft and other scams often rely on incomplete information," wrote Wilson, in the report she prepared for us. "These scams exploit and bypass systems designed to reduce user friction first and provide security second."

One reporter's name triggered matches dating back to 2015 on what Wilson described as a "fraud site" named Black Stuff. His name also popped up among leaked email that included tens of thousands of rows of data from thousands of people. The leaks, Wilson said, may have included passwords.

Someone with the same name appears to be further compromised, she found. That person, "appears repeatedly exposed through work-related leaks of code and information, including contact details."

The other reporter was a bit more obscured, but the findings are nevertheless disturbing. An apartment building where he recently lived is lighting up the dark web.

The address "has partial matches on a series of doxes," she wrote, using a term that refers to the act of publishing someone's contact information as a sort of malicious revenge. Information from people at the residence also appeared on a fraud site called Omerta, as well as on a well-known non-dark web site: WikiLeaks. The leak in that instance involves campaign donations, and information includes people's full names, addresses (including apartment numbers), emails and even phone numbers.

Our personal records are packaged with the records from tens of thousands of other individuals. This year, the seemingly-endless parade of hacks and data breaches includes the video game Fortnite, Dunkin' Donuts, and the Dow Jones company.

The real harm, said Wilson, is that once your data is for sale on the dark web, it's likely to remain there for years to come. "You're just another cog in the wheel. You're just another resource. Data is often repackaged, resold, re-released, which means, if you're exposed once, it's going to be used hundreds, thousands, maybe even millions of times before it's all said and done."

First published on March 25, 2019 / 12:09 PM

© 2019 CBS Interactive Inc. All Rights Reserved.

Dan Patterson

Dan Patterson is a senior producer for CNET and CBS News. He covers the tech trends that shape business, politics, and culture.

dark-web-market.jpg dark-web-pricing.png

We found our personal data on the dark web. Is yours there, too?

Two CBS reporters asked a cybersecurity firm to unearth disturbing information about themselves in the deepest recesses of the internet

0M ago

"No jail time": Dr. Dre jokes about kid's USC acceptance

Dr. Dre wasn't embroiled in the "Operation Varsity Blues" scandal – but he did give millions to USC

15M ago

Father of Sandy Hook victim dies in apparent suicide

Police said they discovered the body of 49-year-old Jeremy Richman at Edmond Town Hall in Newtown, Connecticut

18M ago

Democrats fight for public release of Mueller report

As lawmakers return to Capitol Hill, the pressure is on AG William Barr to release the special counsel's entire report

34M ago

Trump meets with Netanyahu as Israeli military strikes targets along Gaza Strip

The president gave the Israeli prime minister a boost last week with a tweet asserting that Israel should have sovereignty over the Golan Heights

39M ago

Democrats fight for public release of Mueller report

As lawmakers return to Capitol Hill, the pressure is on AG William Barr to release the special counsel's entire report

34M ago

Trump meets with Netanyahu as Israeli military strikes targets along Gaza Strip

The president gave the Israeli prime minister a boost last week with a tweet asserting that Israel should have sovereignty over the Golan Heights

39M ago

John Podesta: "I accept" Mueller report's conclusions

"I think that Democrats would be well to push for the full release of the report," urged former Clinton campaign chair John Podesta

2H ago

Trump's attorney slams Congress' ongoing Russia probes

"Let's get on with the people's business," Sekulow told "CBS This Morning"

3H ago

Klobuchar demands "entire" Mueller report be released

Senator says full report investigating foreign power's attacks on U.S. elections must be released to prevent similar attacks in next election

3H ago

Behind the scenes: Covering the last, long fight against ISIS in Syria

CBS News' Charlie D'Agata and his team hadn't expected to call eastern Syria home for almost 3 months, but ISIS wasn't going without a fight

11M ago

Norway launches probe as cruise passengers recount harrowing rescue

9 still hospitalized after Norwegian cruise ship got stranded in high seas, as officials investigate decision to set sail amid storm warnings

2H ago

How Russian state TV has changed its tune on Donald Trump

From early embrace to a mournful acceptance of reality — tinged with hope — the Kremlin mouthpiece has offered a shifting portrayal of President Trump

4H ago

Russians not celebrating, but hopeful with Mueller probe over

Kremlin yet to respond, but one senior lawmaker says end of investigation, "unties President Trump's hands to re-set relations with Russia"

5H ago

Rocket fired into Israel from Gaza stokes fears of major clashes

Hits home, injures 7, prompts Netanyahu to cut short visit to Washington shortly before Israeli elections

7H ago

"No jail time": Dr. Dre jokes about kid's USC acceptance

Dr. Dre wasn't embroiled in the "Operation Varsity Blues" scandal – but he did give millions to USC

15M ago

Jennifer Lawrence and Adele surprise crowd at gay bar

"I just partied with Jennifer Lawrence and Adele…. I am speechless"

3H ago

"Clueless" cast reunites nearly 25 years after film's release

Fans of the iconic '90s hit were, "totally buggin'"

13H ago

Kathy Griffin on death threats, investigations, and the Trump severed-head photo

In May 2017 the comedian's life turned upside-down after the release of a photo of her holding what appeared to be the severed head of President Donald Trump – a joke that became anything but

Mar 24

Brandi Carlile, the "underdog," surrounded by love

Long a best-kept secret, the favorite musician of the "cool kids" has been preparing for her time in the spotlight her whole life

Mar 24

We found our personal data on the dark web. Is yours there, too?

Two CBS reporters asked a cybersecurity firm to unearth disturbing information about themselves in the deepest recesses of the internet

0M ago

After Paris climate agreement, oil companies pour $110B into fossil fuels

Between 2015 and 2019, fossil fuel investment by major energy companies dwarfed their spending on low-carbon alternatives

6H ago

40 years ago: Three Mile Island nuclear accident

In 1979, in the worst nuclear power plant accident in U.S. history, a series of mishaps caused the release of radiation at the Pennsylvania facility

Mar 24

Almanac: Building the New York City subway

On March 24, 1900 Mayor Robert Van Wyck ceremoniously launched construction of the city's first subway line, commemorated as "Tunnel Day"

Mar 24

FEMA exposed info of 2.3 million disaster victims

The victims affected include survivors of Hurricanes Harvey​, Irma​ and Maria​ and the 2017 California wildfires

Mar 22

Avocados recalled in 6 states over possible listeria

The company said the avocadods were sold in bulk across California, Arizona, Florida, Wisconsin, North Carolina and New Hampshire

19H ago

Does Roundup cause cancer? Law says yes, science says maybe

Two juries have now ruled against the maker of the widely used weedkiller

Mar 22

Tyson recalls frozen chicken strips that may contain metal

Two consumers had complained about finding "extraneous material" in the ready-to-eat chicken strips

Mar 22

Kentucky governor exposed his kids to chickenpox

All nine of the governor's kids were "miserable for a few days" after contracting the virus, he said

Mar 21

Addicted to fentanyl, one man tries to avoid becoming another "overdose statistic"

"I come from a good family. I work 40 to 50 hours a week," a young man named Jacob said

Mar 21

We found our personal data on the dark web. Is yours there, too?

Two CBS reporters asked a cybersecurity firm to unearth disturbing information about themselves in the deepest recesses of the internet

0M ago

Trump sees strong GDP growth. Here's what business economists predict in 2019

Economists have a dimmer assessment of the U.S. economy, citing a global slowdown and ongoing trade conflicts

3H ago

New Jersey lawmakers face "razor thin" vote on recreational pot

While governor pushes for passage and the expungement of marijuana-related criminal records, critics push back, and dozens of towns pre-emptively ban weed

4H ago

After Paris climate agreement, oil companies pour $110B into fossil fuels

Between 2015 and 2019, fossil fuel investment by major energy companies dwarfed their spending on low-carbon alternatives

6H ago

Avocados recalled in 6 states over possible listeria

The company said the avocadods were sold in bulk across California, Arizona, Florida, Wisconsin, North Carolina and New Hampshire

19H ago

Father of Sandy Hook victim dies in apparent suicide

Police said they discovered the body of 49-year-old Jeremy Richman at Edmond Town Hall in Newtown, Connecticut

18M ago

Fire at California mosque investigated as possible arson

Police said the fire caused damage to the Islamic Center of Escondido and crews found graffiti with a hate message spray painted on a wall

18H ago

Did a father brainwash his daughter to help kill her mother?

"48 Hours" examines a case that dives deep into the dynamics of a brutal custody battle, a shocking death of a beloved mother of three and an investigation that leads police in a direction they couldn't have predicted

Mar 23

Suspect arrested in subway attack caught on video

In video that was posted online, the suspect walked up to the 78-year-old woman and kicked her in the face multiple times before exiting the train

Mar 23

Robert Kraft issues first statement since solicitation charge

Kraft was one of 25 men charged as a result of the investigation

Mar 23