Dark web
Reading an exposure
What an exposure detail shows (source, breach date, data classes, password storage), the plain next action, marking it reviewed, and asking for help.
Updated · 2 min read
The detail page
Tap an exposure (iOS: Exposure, the row; API: GET /api/darkweb/breach/:name, tool get_dark_web_breach) for:
| Field | Meaning |
|---|---|
| Source | The breach name as the index reports it (a company, a service, a combined list) |
| Breach date | When the data was taken, which is often years before it was published |
| Data exposed | The classes in the dump: email addresses, passwords, names, phone numbers, addresses, and so on, each a chip |
| Password storage | How the source stored passwords, as reported: plain text, unsalted hashes, bcrypt. Plain text or a weak hash means the password is effectively known |
| Which addresses | Which of your monitored addresses appear in this dump. Two of your addresses in one dump is one exposure with two names on it |
| Next action | A plain paragraph: reset the password if it was reused anywhere, enable two-factor on the mailbox, watch for phishing that quotes the leaked details |
"Open source reference" opens the breach provider's page inside the app when one exists.
Marking it reviewed
Mark as offers three choices:
- Password reset, reviewed
- Mailbox no longer exists
- False positive
A marked exposure moves from New to Reviewed. Tap the choice again to clear it. Marks are saved on this phone for this account; the API returns the exposure list without the per-device marks.
Asking for help
Ask NHM to help starts a support conversation with the exposure summarised for you. On Enterprise that is a thread with a person; on other plans the button explains the option and the next-action paragraph stays.
What the numbers mean
The status payload counts monitored addresses and total breaches, and the "recent exposures" strip is capped at the 50 newest so a heavily breached address does not turn the tab into an archive. GET /api/darkweb/status never calls the upstream index; it reads the cache.
Common questions
The breach says passwords were bcrypt. Do I still need to act? A strong hash buys time, not safety. If the password was reused anywhere, change it there.
Why is the breach date so old? Dumps circulate privately for years before an index sees them. The date shown is the breach, not the discovery.
Keep reading
Related articles
- A tour of the web dashboardWhat each page of nhmohio.com/dashboard shows: Overview, Alerts, Fixes, Domains, Software, Security, SEO, Monitoring, Reports and Compliance, plus Settings and Help.Getting started ·Updated
- Findings, carry-forward and dismissalsWhat a finding shows, why a finding from a heavier scan survives a lighter one, and the four reasons a finding, a software reading or an alert can be silenced.Vulnerabilities and exposure ·Updated
- Offline, background refresh and app settingsWhat the app shows without a network, how the domain cache is kept warm in the background, and the Appearance, App detail, haptics and saved-filter settings.iOS app ·Updated