BlogLine

Data doesn’t disappear. It just goes dark

6/12/25

By: Alexander L. Tang

Personally identifiable information, protected health information and other sensitive data don’t go into a black hole after they’re stolen. It goes on the Dark Web, which has become a reliable repository of PII and PHI. The bank of sensitive info is so extensive that criminals are offering data lookup services on the Dark Web, akin to people search services available on the Clear Web.

All this searchability begs the question: Is there anything left to steal? 

The life cycle of compromised data rarely ends with the initial breach. Instead, it is frequently redistributed across cybercrime forums, aggregated with other leaked information and repurposed by threat actors through new channels. 

Illicit “data lookup services” allow anyone to query sensitive data such as names, email addresses, Social Security numbers, passwords, financial details and health information that have been previously leaked, often with little more than a cryptocurrency payment. 

As most of us suspect, the full extent of our lives, including our PII, is probably already available. 

As these kinds of services become more accessible, they could provide further support for a de minimis harm defense in data breach cases.  

The operation and proliferation of these data lookup services also reinforce the need for robust data security practices and proactive incident response planning in business. We recommend that businesses remain vigilant to evolving threat actor tactics and coordinate with trusted legal counsel to assess risks and implement incident response strategies. 

For more information, please contact Alexander L. Tang at alexander.tang@fmglaw.com or your local FMG attorney.

Information conveyed herein should not be construed as legal advice or represent any specific or binding policy or procedure of any organization. Information provided is for educational purposes only. These materials are written in a general format and are not intended to be advice applicable to any specific circumstance. Legal opinions may vary when based on subtle factual distinctions. All rights reserved. No part of this presentation may be reproduced, published or posted without the written permission of Freeman Mathis & Gary, LLP.