Searchable timeline of publicly reported breaches with affected organizations, dates and data types.
Directory
Dark Web & Underground
Dark Web and Underground collects research, journalism, and tools that relate to hidden services and anonymous publishing. Whistleblowing and anonymous publishing covers secure drop systems and submission platforms. Tor and hidden services holds the software, directories, and explanation pages around the Tor network. Dark web research and studies and dark web news and analysis gather academic work, reports, and reporting on how these networks are used. Breach and leak research lists data breach checkers and disclosure trackers, and deep web resources and discovery covers guides to what sits beyond indexed pages. Archives and historical records, dark web search and directories, and underground communities and forums make up the remaining topics. Several entries here are news archives or academic projects rather than services you sign up for, so weigh each one by who published it and when.
Public-interest archive preserving leaked and released datasets for journalism and historical research.
Der Spiegel instructions for submitting documents securely through its verified SecureDrop service.
Dizzy is an open-source crawling and analysis system for onion services. It implements techniques to explore, update, check, and classify onion services at scale without overwhelming the Tor network. It was deployed in April 2021 and used to analyze more than 63.3 million crawled onion webpages, focusing on domain operations, web content, cryptocurrency usage, and web graph.
eCrime.ch is an extortion exposure monitoring platform for enterprise security, incident response and third-party risk teams. It detects, verifies and delivers ransomware and data-leak signals with context such as entity mapping, artifacts, links and timelines. The site states it monitors 280+ extortion and leak sources and delivers alerts through dashboard, email, Slack, API and reports. A REST API provides tracker, intelligence, file-search, screenshot, actor, leak-site and torrent-monitoring data.
Europol and EMCDDA report on darknet drug markets, policy implications and research evidence.
Europol assessment of online organized crime, including criminal services and dark-web developments.
ExoneraTor is a Tor Metrics service that maintains a database of IP addresses that have been part of the Tor network. It answers whether a Tor relay was running on a given IP address on a given date. It may store more than one IP address per relay and records whether a relay permitted transit of Tor traffic to the open Internet at that time.
Checker for seeing whether a phone number or profile appears in Facebook-related breach data.
Financial Times instructions for submitting documents securely through its verified SecureDrop service.
National Transportation Library record for research on discovering and cataloging hidden-web resources.
Research articles on dark-web monitoring, exposed data, cybercrime groups and external threats.
Intelligence analysis covering illicit communities, ransomware groups and underground online activity.
Forbes SecureDrop is an open-source whistleblower submission system that media organizations such as Forbes use to securely accept documents from and communicate with anonymous sources. Users access the SecureDrop page through the Tor browser and follow instructions to send information. Users receive a codename to log back in and check for responses from Forbes reporters.
Forbidden Stories instructions for submitting documents securely through its verified SecureDrop service.
A collection of guides from the Freedom of the Press Foundation on source protection for journalists working on sensitive subjects. The guides cover creating processes to keep journalists and sources safe, addressing the first contact problem, Signal setup, security considerations for confidential tip pages, working with whistleblowers, address book risks, and sharing sensitive leaks with the press.
Explains how metadata and structured access affect discovery of database-backed and deep-web content.
GlobaLeaks is free, open source software for setting up and maintaining a secure whistleblowing platform. It is designed as a framework for anonymous reporting, with privacy protection and submission protection enabled by default, and has been translated into over 70 languages. The source code is public and has been examined in independent security audits since 2011.
Community support forum for organizations and developers operating GlobaLeaks whistleblowing sites.
Greekleaks instructions for submitting documents securely through its verified SecureDrop service.
Have I Been Pwned is a data breach search and notification service. It lets users check whether an email address appears in known data breaches and lists instances where data was found in paste records. It also offers an MCP server that connects AI agents to breach, password, paste, domain and stealer log data.
An arXiv paper on discovering skylines over hidden web databases whose search interfaces enforce a top-k output constraint. It examines how search interface controls affect discovery cost and develops algorithms for one-ended range, free range and point predicates, combined for mixed interfaces. Experiments over real-world online and offline databases are reported.
An arXiv paper on digging deeper into hidden web databases limited by the top-k output constraint. It presents the GetNext meta-algorithm, which retrieves the next ranked tuple through a restrictive interface without prior knowledge of the ranking function, and algorithms that generate and execute multiple reformulated queries. Theoretical analysis and experiments over synthetic and real-world databases are reported.
Historical visualization and research record mapping a sample of linked Tor onion services.