The dark web has evolved from a simple stolen-data marketplace into an organised criminal supply chain. AI is making attacks cheaper and more convincing. Personal data , even years-old information , retains value as a tool for phishing, identity theft, and pressure campaigns targeting both individuals and institutions.
What “Industrialisation” Actually Means
Pierluigi Paganini, cybersecurity expert and founder of Security Affairs, described the shift clearly when speaking to La Voce di New York. “In the past, it was mainly a place to buy and sell stolen data, credentials, malware and illegal services. Today, we are witnessing a true industrialization of cybercrime.”
The phrase is precise. What’s changed isn’t just scale , it’s structure.
A decade ago, most dark web crime was relatively straightforward: someone hacked a database, stole credentials, and sold them. The same person generally did all of that. Today, criminal operations on the dark web work more like a supply chain, with specialised roles that rarely overlap:
Initial access brokers focus entirely on breaking into corporate networks and then selling that access to others. They don’t use it themselves. They sell it. This is why supply chain attacks often show early warning signs on the dark web weeks before the breach becomes public.
Ransomware groups buy that access, deploy their malware, and handle the extortion side. The AudiA6 laundering network we covered existed specifically to convert ransom payments into clean, spendable cryptocurrency , a third layer of specialisation within the same criminal ecosystem.
Platform operators build and run the marketplaces that connect buyers and sellers of everything from stolen data to hacking tools. When Raheim Hamilton built Empire Market from 2018 to 2020 , processing four million transactions worth $430 million , he was running what was functionally a criminal e-commerce platform with vendor ratings, customer support, and built-in money laundering features.
This division of labour is exactly what makes it harder to investigate, as Paganini notes: “It is an increasingly organised criminal supply chain, in which different actors collaborate without necessarily knowing one another.”
Why Your Old Data Is Still Dangerous
One of the most important points in Paganini’s analysis is easy to overlook: stolen data doesn’t expire.
A password stolen two years ago might be used today to access a completely different account, particularly if the person reused that credential. Personal information from an old breach can fuel a phishing campaign that feels new and targeted, because it uses real details about the victim to seem credible.
This matters because people often see a breach notification and think: “that happened a while ago, I changed my password, I’m fine.” But the data that was taken , your name, address, employer, previous passwords, date of birth , is still in circulation. It can be combined with data from newer breaches to build increasingly detailed profiles. As we covered in looking at the synthetic identity fraud market, assembling a complete fraudulent identity from fragments of multiple breaches is now a commercial operation.
Europol’s April 2026 report confirms this picture at the institutional level, describing a criminal landscape that is both more sophisticated and more commercially organised than anything documented in previous years.
The Role of AI Is Real , but Not What You Might Think
Artificial intelligence is making dark web-facilitated crime more effective, but not through autonomous robot hackers. It’s more subtle and more practical than that.
AI tools give criminals who lack advanced technical skills the ability to do things that previously required expertise. A convincing phishing email used to require skill to write; today it can be generated and personalised at scale. A deepfake video impersonating a company executive can be created from a few seconds of publicly available footage. Voice cloning from social media audio can produce a “phone call” from someone’s boss asking for an urgent wire transfer.
“Today, we can no longer trust only what we see or hear: even a familiar voice or an apparently authentic video can be generated or manipulated with AI,” Paganini warns. This connects directly to what Google’s Threat Intelligence Group reported in September 2026 ,dark web markets are selling stolen AI platform credentials and cheap access to frontier AI models specifically to give criminal operators these capabilities.
At the same time, AI also helps defenders. Anomaly detection, faster incident response, and pattern recognition in large data sets are all areas where AI-powered security tools are making a real difference. The technology cuts both ways.
Personal Data as a Political Weapon
The Italian case involving Antonio Tajani adds a dimension that extends well beyond financial fraud.
The targeting of a serving foreign minister and senior law enforcement officials with data-collection bounties on underground forums isn’t about stealing bank account access. It’s about building leverage, enabling blackmail, or gathering operational intelligence about individuals with significant institutional power.
This is what Paganini means when he says “stolen data is not necessarily the ultimate objective of the attack: it can become the starting point for much more complex operations.” A politician’s home address, travel schedule, family relationships, and communications metadata can serve objectives that have nothing to do with financial crime.
The involvement of NoName057(16) , a pro-Russian hacktivist group known for targeting NATO-aligned countries , suggests that the Italian campaign is at least partly geopolitical. This is consistent with a broader 2026 pattern of state-adjacent actors using dark web infrastructure for intelligence operations and political pressure, not just theft.
What You Can Do
Paganini is careful to avoid alarmism. “Finding your data on the Dark Web does not automatically mean that you were the victim of a recent attack.” The goal is informed awareness, not panic.
That said, there are practical steps that meaningfully reduce risk:
Use different passwords for every service. A password manager makes this manageable. The credential reuse problem is one of the most reliably exploited weaknesses across all dark web-enabled fraud.
Enable multi-factor authentication wherever it’s available, and use an authenticator app rather than SMS wherever possible , SMS codes can be intercepted in ways that app-generated codes cannot.
Keep devices and software updated. Many attacks exploit known vulnerabilities in software that hasn’t been patched.
Verify unexpected requests through a separate channel. If you receive an email, text, or even a call from someone you know asking for money or sensitive information, call them back on a number you already have. Don’t reply through the same channel the request came through.
For a full checklist of what to do if your data is already circulating online, our guide on responding to dark web data exposure covers the steps that actually make a difference.
Frequently Asked Questions
Is the dark web illegal to use?
No. The dark web itself is not illegal. Tor, the software used to access it, was originally developed for privacy purposes. What’s illegal is what some people do on it , buying and selling stolen data, drugs, hacking tools, and other criminal services.
How does the dark web criminal economy work?
It now operates like a supply chain. Separate specialists handle initial access to networks, ransomware deployment, money laundering, and marketplace operation. They often don’t know each other and communicate only as needed for specific transactions.
Is your data valuable even if it’s years old?
Yes. Old passwords, addresses, and identity details retain value for phishing, synthetic identity fraud, and profile-building. Criminals combine data from multiple breaches to create more complete and exploitable profiles.
What is NoName057(16)?
A pro-Russian hacktivist group known for targeting institutions in NATO-aligned countries, often using DDoS attacks and data exposure campaigns for political purposes rather than financial gain.
What is the single most effective protection against dark web-enabled fraud?
Not reusing passwords. If your credential from one breached service is used for another, one exposure becomes many. A password manager makes unique passwords for every service practical.
