A dark web scan checks whether identifiers such as an email address or password match information in sources the service monitors. A match is a warning to investigate, not proof that someone has accessed your account or stolen your identity. Google’s Dark Web Report, once used for this purpose, is no longer available: new-breach scans stopped January 15, 2026, and the report and related data were removed February 16, 2026.
What a dark web scan does—and what it cannot establish
A scan compares information you provide, such as an email address, username, password, or identity number, with data available to the provider’s monitoring systems. An alert means the service found a possible match in the sources it checks. It does not establish that the information is current, that an account is being accessed, or that identity theft has occurred.
Coverage depends on the service: the sources it can access, the identifiers it checks, and whether it performs a one-time search or ongoing monitoring. No scan should be treated as a complete inventory of every exposure. Nor does an alert mean the service can remove information from third-party breach records.
Google’s Dark Web Report is discontinued
Google says its Dark Web Report stopped scanning for new breaches on January 15, 2026. The report became unavailable and its associated data was deleted on February 16, 2026. Google explained that feedback indicated the reports offered general information without sufficiently helpful next steps. The feature is therefore not an option for checking new exposures today. Google’s announcement and recommended account-security tools describe the change.
#1 Best Overall
Google points users to Security Checkup, passkeys and other authentication tools, Google Password Manager and Password Checkup, and Results about you. These tools can help protect accounts or find and request removal of certain personal information from Google Search results; they do not replace steps required after a specific breach.
What to do after a dark web alert
- Check whether the alert is genuine. Do not click links or call numbers in an unexpected message claiming your data is for sale. If it might be legitimate, contact the company through a website or phone number you independently know to be real. The FTC’s identity-theft guidance recommends this approach.
- Secure the affected account and your email. Change the exposed password, plus any other password that reused it. Start with email: access to that inbox can let someone reset passwords for other accounts. Use a different, unique password for each account; a password manager can help you keep track.
- Turn on multifactor authentication. Enable it wherever the account supports it. Passkeys or a compatible security key may be available options, depending on the account and device.
- Assess financial and identity exposure. If the alert involves financial details or identity information, review your credit reports and look for unfamiliar accounts or activity. A credit freeze is free to place and remove and can make it harder for someone to open new accounts in your name. A fraud alert is another free option; choose based on your circumstances and the information exposed.
- Report suspected identity theft. If you find an account or transaction you do not recognize, use IdentityTheft.gov to report it and get a recovery plan. The steps depend on what information was exposed; the FTC notes, for example, that a stolen Social Security number may be used to open accounts or commit tax identity theft. See its data-breach response guidance.
How to assess a monitoring service
Before sharing personal information or paying for monitoring, check what the service actually covers. A provider’s description is evidence of what it advertises, not independent proof that its search is exhaustive or that it will find every exposure.
- Identifiers: Which details does it monitor—email addresses, usernames, passwords, account numbers, or identity numbers?
- Sources and geography: What types of sources and regions are included? Do not assume any service searches the entire dark web.
- Timing: Is the result a one-time historical scan or continuing monitoring?
- Alerts and support: Does an alert name the affected account and exposed information, explain practical next steps, or include recovery help?
- Privacy and terms: What information must you submit, how is it handled, and what are the current price, eligibility, and cancellation terms?
For example, Malwarebytes describes its identity-protection service as monitoring thousands of websites and other sources, including dark web sources, for personal data and credentials. Its listed categories include account numbers, identity numbers, email addresses, usernames, and passwords. These are the company’s claims about its own service, not an independent accuracy or coverage assessment.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
