IT security: dark web monitoring

Dark web monitoring in Christchurch

OxygenIT is a Christchurch managed IT and cyber security provider for businesses of 20 to 200 staff. Our monitoring watches dark web marketplaces, forums and paste sites continuously and alerts you within hours when a staff credential is exposed, so a leaked password never becomes a breach.

Book the 15-Minute Founder Call

Or call 0800 242 206

Watch: how leaked passwords get used against your business

Why most businesses learn about a breach too late, from a client or the bank rather than their own systems.
How a reused staff password from a third-party breach ends up for sale and is tested against Microsoft 365 within minutes.
Why a one-off free breach check is a single snapshot, not monitoring.
What a managed service does the moment a credential is exposed.

Signs your business data may already be exposed

Most businesses do not discover a data breach through their own systems. They find out when something goes wrong. A client calls about a suspicious invoice. Staff are locked out of their accounts on a Monday morning. Or the bank rings.

By then the login details have often been traded on dark web marketplaces for weeks, sometimes months. The common path is simple. A staff member reuses their work email and password on a third-party website. That website is breached. Their login appears in a data dump with thousands of others, available for purchase, and the business remains unaware.

Look for these indicators:

Unusual login attempts or account lockouts, especially outside normal business hours.
Clients or suppliers reporting phishing emails that appear to come from your domain.
Password reset requests that nobody in your team initiated.
New mail forwarding rules in Microsoft 365 mailboxes that you did not set up.

Any of these can mean credentials are already in the wrong hands, and most are easy to miss. A forwarding rule hidden in Outlook settings does not trigger an alert. It quietly copies every email to an external address.

Christchurch has many professional services firms in the CBD and Addington, including accounting and legal practices that handle sensitive client data. They are common targets. Attackers do not need to get past a firewall. They need one valid username and password from a data dump. Dark web monitoring closes the gap between a credential appearing in a breach and your team knowing about it. Without it, you are relying on chance, and we have worked in this field since 2005 without finding a business of 20 or more staff for whom chance was a sound strategy.

Dark web monitoring versus free breach checkers

You may have entered your email address into a free breach-check website and learned that your details appeared in a breach from 2019. That is useful. It is also a single snapshot, not an ongoing service.

Free tools compare your address against a fixed database of known breaches. They show you past events. They do not watch for new listings, they do not scan the forums where credentials are traded, and they will not alert you when new data from your organisation goes on sale.

Dark web monitoring is continuous. It runs across marketplaces, paste sites and private channels that free checkers cannot access, as part of our managed SOC. When a staff member’s work email and password appear on a new listing, you hear about it in hours, not months. That window matters. A login pair from a Christchurch accounting firm can be tested against Microsoft 365 within minutes of being listed.

Three further differences:

Free checkers cover only the addresses you type in. If you have 50 staff, nobody is checking all 50 every week. A managed service covers your whole domain, every address, alias and variation.
Free tools give you information but no next step. A managed alert comes with context and a response path: which credential was exposed, whether it is still active, and what to change today.
We are certified to ISO/IEC 27001:2022, so every alert follows a documented workflow inside a formal information security management system. Alerts do not get lost in someone’s inbox.

Free tools have their place for personal use. For a business of 20 to 200 staff they leave too many gaps.

When your business can skip managed monitoring

Some businesses do not need this service yet, and we would rather say so than sell it.

If you are a sole trader with no employees, no client data beyond a basic contact list and a single email account, managed dark web monitoring is not your first priority. Multi-factor authentication and a password manager will close most of your gaps on their own.

The same applies if you already have an in-house security team. If someone on your staff continuously monitors credentials, rotates compromised passwords within hours and reports on exposure across every domain your organisation uses, you are already doing this. There is no value in paying twice for the same result.

The common mistake is believing it is covered because of a one-off check on Have I Been Pwned six months ago. That is not monitoring, it is a snapshot. New credential dumps from supplier breaches appear every week, and a single check tells you nothing about last week.

Ask yourself one question. Can you say today whether any of your staff credentials are on a dark web marketplace? If the answer is “I do not know” or “probably not”, that is a gap, not confidence. For Christchurch professional services firms holding client records under the Privacy Act 2020, that gap is a regulatory risk as well as a technical one. Many of the 100+ New Zealand businesses we have supported since 2005 started from exactly this point.

How Christchurch businesses respond to a dark web alert

An alert arrives. Many businesses freeze at this point: a notification says credentials are on a marketplace and nobody knows the first step. The right response is not panic. It is a short, clear process that stops the damage before it spreads.

Identify the extent

A password on its own is different from a full email and password pair, and a client database dump is another matter entirely. The alert gives you the scope. We help you read it correctly so you are not guessing.

Contain it the same day

Force password resets on every affected account within the hour. If multi-factor authentication is already on, the exposed credential is worth far less to an attacker. If it is not, that gap is closed the same day.

Trace the source

Was it a phishing email clicked three months ago? A password reused from a personal account? A former staff login never deactivated after they left? Christchurch professional services firms, particularly the accounting and legal practices along Victoria Street, often find the last one. That is a process gap, not a technology failure.

Close it

Tighten email protection rules, run a phishing simulation through security awareness training, or fix the password policy. We walk you through each stage so the same leak path does not open again.

A dark web alert does not mean you have already been breached. It means you have been warned. The difference between a warning and a disaster is usually about 48 hours of focused response. Businesses with a plan act quickly. Businesses without one tend to call us after the damage is done.

Layering monitoring with MFA and password management

Dark web monitoring finds the problem. It does not fix it. That is why we pair it with multi-factor authentication and password management for every account your team uses.

Monitoring finds the leaked login. Multi-factor authentication stops it being used. Password management makes sure the same credential is not valid anywhere else. Without MFA, a leaked email and password is an open door. With it, the attacker holds a key and meets a deadbolt.

MFA alone is not enough if your team reuses passwords. One credential leaked from a personal shopping site can unlock your practice management software, your cloud backups or your accounting platform. A password manager breaks that chain by generating a unique credential for every login, and retires the sticky notes and shared spreadsheets along the way.

What proper layering looks like:

Monitoring flags a compromised credential within hours of it appearing on a forum or marketplace.
Our team resets the affected password and checks for reuse across other systems.
Multi-factor authentication blocks any login that fails the second step.
Password management enforces unique, strong credentials so the same exposure does not recur.

Most Christchurch businesses we meet have MFA on email and nowhere else. Attackers know that. If you run dark web monitoring without these supporting layers you will receive alerts, but you may not act fast enough to matter.

Related IT security services in Christchurch

Endpoint detection and response (EDR): catch what gets past the perimeter.
Vulnerability assessments: find the gaps before attackers do.
Managed SOC: the continuous monitoring service this sits inside.

See the full IT security services range.

Frequently asked questions

How fast will I know if my business data shows up on the dark web?

Usually within hours of a new listing, not months later. Managed monitoring scans marketplaces and forums continuously, so a leaked password does not sit unnoticed. This matters because attackers often test stolen logins against Microsoft 365 within minutes of posting them. A fast alert gives your team time to change passwords before anyone gets in.

What happens after we sign up for dark web monitoring?

We connect your full domain, so every staff email and alias is covered automatically. You do not submit addresses one by one or remember to check them. Alerts arrive with context: which credential was exposed, whether it is still active, and what to do next. It runs as part of our managed SOC.

Do small businesses in Christchurch need this, or is it just for big firms?

It depends on your setup, but many small Christchurch firms are exposed. Professional services businesses in the CBD and Addington hold client data that attackers specifically target. If staff share logins across personal and work accounts, you have exposure regardless of size. Sole traders with no staff and minimal client data get more value from multi-factor authentication first.

Is checking Have I Been Pwned once enough to stay safe?

No. A single check shows past breaches, not what is happening now. New credential dumps appear every week from supplier and third-party breaches. A one-off search six months ago tells you nothing about a leak from last week. Ongoing monitoring catches new listings as they happen, which is the gap free tools leave open.

What are the warning signs that our credentials are already exposed?

Login attempts outside normal hours, password reset requests nobody made, and new mail forwarding rules in Microsoft 365 that nobody set up. Clients reporting phishing emails that look like they came from your domain is another. These hide in settings menus rather than triggering obvious alerts, and spotting them usually means a credential is already circulating. A vulnerability assessment will find the rest.

Find out what is already exposed

Can you say today whether any of your staff logins are on a dark web marketplace? If the answer is “I do not know”, that is a gap, not confidence. Fifteen minutes with a founder, not a sales rep, and we will tell you plainly where you stand.