In 2021, 100 million MobiKwik users had their KYC records — including Aadhaar numbers, PAN cards, and passport photos — listed on a dark web marketplace. MobiKwik denied the breach for weeks. The data was already selling.
That gap between “breach happens” and “company admits it” is exactly what dark web monitoring is designed to close. But before you decide whether it’s worth using, you should understand what it actually does and where it stops.
The short answer: Dark web monitoring scans breach dumps, paste sites, and dark-web forums for your identifiers (email, phone, PAN, Aadhaar) and alerts you when a match appears. It finds credential pairs, PII dumps, financial bundles, and full KYC packages. It misses private broker sales, closed Telegram groups, breaches not yet public, and offline leaks. It detects exposure; it doesn’t prevent breaches or remove data. Pair it with broker removal to reduce how findable that data is.
What is the dark web?
The dark web is not a single place. It’s a layer of the internet that requires special software — primarily the Tor browser — to access. Tor routes your connection through multiple encrypted relays, making both your identity and the server’s location hard to trace.
Most of the dark web is mundane: privacy forums, whistleblower platforms, journalists protecting sources in authoritarian countries. The part that matters for data exposure is the dark web marketplace — sites that function like Amazon, except the products are stolen data, fake documents, and compromised accounts.
These marketplaces have ratings, seller reviews, and customer support. They’re businesses.
What Indian data sells for
On these marketplaces, your data has a price. And it’s cheaper than you’d expect.
Bulk records — name, phone, email — sell for around ₹500 per 10,000 entries. That’s ₹0.05 per person. Financial packages with PAN and bank account details fetch ₹5,000 to ₹15,000 for a full KYC bundle including Aadhaar, photo, and address proof. These prices come from breach research firms that monitor marketplace listings.
The MobiKwik data — 100 million records with full KYC — was being offered for around 1.5 Bitcoin (roughly ₹60–82 lakh at March 2021 prices). Individual records were also being sold separately. That’s the scale of what one breach produces.
What makes Indian data particularly attractive? Aadhaar links your biometric identity to your financial history. A single leaked KYC package contains more usable information than most countries’ breach data — it’s the identity verification infrastructure turned against you.
What does dark web monitoring actually do?
Dark web monitoring services continuously scan known breach repositories, paste sites (like Pastebin), and dark web forums for data dumps containing your personal identifiers.
You give the service your email addresses, phone numbers, PAN, and Aadhaar (a partial hash, in responsible implementations). The service checks these against a database of known breaches and alerts you when a match appears.
Services like HaveIBeenPwned cover major global dumps and are free for email checks. Dedicated monitoring scans more sources on an ongoing basis. That includes India-specific breach data and Telegram channels, where breach data circulates before it reaches public repositories. KnytX Shield is built to include this on Pro and above once it launches.
The alert tells you: this dataset was breached, it appeared here, and your identifier was in it.
What it finds
When your data appears in a monitored dump, a good monitoring service will surface:
Credential pairs — your email address combined with a password (often plaintext or weakly hashed). These are used in credential stuffing attacks — automated login attempts across banking, UPI, and shopping sites.
PII dumps — name, phone number, Aadhaar or PAN combinations. These are sold to spam operations, used in SIM swap fraud, and occasionally used for loan fraud where your identity is used to apply for credit.
Financial data bundles — bank account numbers, credit card details, IFSC codes. Usually from fintech or banking breaches.
Full KYC packages — everything above, plus photo ID, address proof, and selfie. The complete package for identity fraud. MobiKwik’s breach fell into this category.
When monitoring catches any of these, you have a window to act: change passwords, freeze Aadhaar-linked services, alert your bank.
What it misses
This is the part most monitoring services won’t tell you directly.
Private broker sales — not all breach data goes to public marketplaces. High-value datasets (C-suite executives, government employees, HNI banking data) are sometimes sold directly between buyers and sellers through private Telegram channels or encrypted messaging. These never appear in scanned repositories.
Zero-day breaches — a company’s data can be exfiltrated today and not appear publicly for months. Monitoring only catches data that has already surfaced somewhere scannable. The breach you don’t know about yet is outside its reach.
Closed Telegram groups — a significant volume of Indian breach data circulates in private Telegram channels before it reaches any public dump. Monitoring coverage here is partial at best.
Physical world leaks — your data copied from a gym’s paper registration, photographed from a hotel check-in form, or sold by a mobile SIM retailer. None of this enters a digital breach dump.
Monitoring is a detection tool. It tells you what’s already out there. It doesn’t prevent the breach, and it doesn’t remove the data once found.
Why do monitoring and removal work together?
Detection without action is just anxiety.
When monitoring surfaces your data in a dump, the practical problem is what happens next. That data feeds clearnet data broker sites: the people-search sites that aggregate and resell breach data into searchable profiles. Anyone can look you up. That’s where the actual harm materializes: spam calls, identity fraud, targeted phishing.
Removal addresses that second step. Getting your data off data broker sites doesn’t undo the breach. But it removes the easily searchable, freely accessible version of your profile. The two-step approach: monitoring catches what’s been exposed, and removal reduces how findable that data is.
If you want to understand how data broker sites build those profiles from breach data, read our post on removing your data from the Indian internet.
Frequently asked questions
What does dark web monitoring find? It surfaces your identifiers in breach dumps: credential pairs, PII dumps (name, phone, PAN, Aadhaar), financial bundles, and full KYC packages. When it catches a match, you get a window to change passwords and alert your bank.
What does dark web monitoring miss? Private broker sales, closed Telegram groups, breaches not yet public, and offline leaks (paper forms, SIM-retailer copies). It only catches data that has already surfaced somewhere scannable.
Is dark web monitoring worth it? It’s useful as early warning, but it’s detection only. It won’t prevent a breach or remove your data. Pair it with data-broker removal so exposed data is harder to find and use.
Can I check the dark web for free? Yes, partly. Have I Been Pwned checks your email against major public dumps for free. Dedicated services scan more sources, including India-specific breaches and Telegram channels, on an ongoing basis.
What you can do right now
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist to get in early.