Dark web
Reading an exposure
What an exposure detail shows (source, breach date, data classes, password storage), the plain next action, marking it reviewed, and asking for help.
Updated · 2 min read
The detail page
Tap an exposure (web: Security, Dark web, the breach; iOS: Exposure, the row; API: GET /api/darkweb/breach/:name, tool get_dark_web_breach) for:
| Field | Meaning |
|---|---|
| Source | The breach name as the index reports it (a company, a service, a combined list) |
| Breach date | When the data was taken, which is often years before it was published |
| Data exposed | The classes in the dump: email addresses, passwords, names, phone numbers, addresses, and so on, each a chip |
| Password storage | How the source stored passwords, as reported: plain text, unsalted hashes, bcrypt. Plain text or a weak hash means the password is effectively known |
| Which addresses | Which of your monitored addresses appear in this dump. Two of your addresses in one dump is one exposure with two names on it |
| Next action | A plain paragraph: reset the password if it was reused anywhere, enable two-factor on the mailbox, watch for phishing that quotes the leaked details |
"Open source reference" opens the breach provider's page inside the app when one exists.
Marking it reviewed
Mark as offers three choices:
- Password reset, reviewed
- Mailbox no longer exists
- False positive
A marked exposure moves from New to Reviewed. Tap the choice again to clear it. Marks are saved on this phone for this account; the web shows the exposure list without the per-device marks.
Asking for help
Ask NHM to help starts a support conversation with the exposure summarised for you. On Enterprise that is a thread with a person; on other plans the button explains the option and the next-action paragraph stays.
What the numbers mean
The status payload counts monitored addresses and total breaches, and the "recent exposures" strip is capped at the 50 newest so a heavily breached address does not turn the tab into an archive. GET /api/darkweb/status never calls the upstream index; it reads the cache.
Common questions
The breach says passwords were bcrypt. Do I still need to act? A strong hash buys time, not safety. If the password was reused anywhere, change it there.
Why is the breach date so old? Dumps circulate privately for years before an index sees them. The date shown is the breach, not the discovery.
Keep reading
Related articles
- Mailbox exposure monitoringAdd an address at your own domain, choose a cadence, run a check now, and understand the plan limits, the upstream rate limit, and hashed storage.Dark web ·Updated
- Certificate monitoringWhere certificate data comes from, what the Certificate module shows, subdomain certificates, and the quiet rule for certificates that renew themselves.Domains ·Updated
- Findings, carry-forward and dismissalsWhat a finding shows, why a finding from a heavier scan survives a lighter one, and the four reasons a finding, a software reading or an alert can be silenced.Vulnerabilities and exposure ·Updated