As more personal information is stored and shared online, cybercriminals are finding new ways to exploit exposed data. New research highlights the growing awareness gap among consumers and the steps individuals can take to better protect their digital identities.
Millions of Brits now save their personal data online as an everyday convenience, whether entering their full name and date of birth to log into social media accounts quickly or storing bank card details and passwords across multiple websites to make online shopping easier.
As digital interactions increase, so does the risk of exposing sensitive information to cybercriminals. Personal data can be sold on the dark web for a low price and many people are unsure what steps to take if their data is compromised.
It’s not just individual data that’s at risk. The Department for Education revealed that 607,000 records were obtained by hackers. Data stolen in the attack includes the telephone numbers and email addresses of individuals and organisations; however, no sensitive or financial information was exposed.
A Bridewell survey reveals nearly 72% of respondents do not know what to do if their information is traded on the dark web, underlining a significant knowledge gap that puts many at risk of identity theft, fraud and further exploitation.
The cost of personal data on the dark web varies significantly depending on the type of information, but personal details could be sold for as little as £5. Research has found that credit card details cost around £8 on the dark web, while a scan of a driver’s licence could cost around £6. Given that data is often bought in bulk on the dark web and resold many times over, these prices may reflect the upper value of this data, with some data being available at much lower cost. Attackers can get real value by linking multiple records together, such as date of birth, passwords and mother’s maiden name.
Cyber-attacks have become increasingly common, with UK retailers including Marks & Spencer, Harrods and The North Face facing major cyber-attacks in the past year. The North Face revealed that cybercriminals had used a method known as ‘credential stuffing’.
In this technique, attackers use usernames and passwords stolen from previous data breaches or bought on the dark web, hoping users reused the same credentials across different accounts.
When criminals sell victims’ data on the dark web, victims can face devastating consequences. Attackers may use the data to commit fraud, access bank accounts and even open new lines of credit in the victim’s name. Many victims struggle financially and emotionally to recover their identity.
In the survey of 1,000 Brits, it was revealed that more than 50% of people aged 35 and over would not be sure what to do if their data were found on the dark web. Those aged between 25 and 34 are the most confident, with 46% stating they would know what to do if their data were leaked on the dark web.
However, the data reveals that younger generations aren’t necessarily more confident in what to do, as just 32% of those under 25 admitted they’d know what to do if their data was found on the dark web.
Anthony Young, CEO at Bridewell, said: “As digital life becomes more integrated into daily routines, we must not lose sight of the risks involved in sharing and storing personal data online. Our survey highlights the urgent need to raise awareness and educate individuals on how to respond if cybercriminals compromise their data. Cybercriminals continue to increase their sophistication, so people must move beyond simply securing passwords to understand the full threat and take proactive steps to protect themselves.
“In reality, people buy and sell personal data on the dark web for a fraction of its true value, putting millions at risk. Businesses must also protect their customers’ information and should regularly educate them on safe digital practices.”
What to do if your data is found on the dark web:
- Identify the problem: Use reputable breach-check tools such as Have I Been Pwned to see if your email or credentials have appeared in known data breaches, while Google’s Dark Web Report can identify if your personal details have appeared on the dark web.
- Update passwords immediately: It’s best to update your passwords immediately if you find out your details have been involved in a data leak or appeared on the dark web. A good password is ideally completely random, with no personal details included. Consider opting for three random words that are memorable to you. Avoid words like password or qwerty, or consecutive numbers like 1234, as these are most used.
- Set up a password manager: Using unique passwords that are sufficiently complicated across many accounts makes it difficult to remember each password, which means many people use the same password across multiple accounts. Rather, set up a secure password manager to manage all passwords. A password manager can also notify users that a password has been involved in a data breach.
- Set up 2FA: It’s best to add an extra layer of security where possible. Even if a password is stolen, two-factor authentication can prevent unauthorised access to accounts.
- Monitor your credit score regularly: You can monitor your credit score regularly through credit reference agencies like Equifax or Experian. If you notice any new accounts you didn’t apply for, you can contact the lenders directly to report the issue.
