All articles

Updated

5 min read Security

Understand the different types of exposure

By Anthon Wansland

Head of Product & Co-Founder

Reviewed by Ida Nilsson

Customer Success Manager

Serus sorts the exposures it finds into three types: dark web exposure (stolen data from breaches), surface web exposure (your details in search results and on public pages) and data broker exposure (profiles that companies compile and sell). Each type affects you differently and needs a different fix, so knowing which is which tells you what to do first.

Key takeaways

  • Serus sorts the exposures it finds into three types (dark web, surface web and data broker), and each one needs a different fix.
  • Data on the dark web can't be taken back, so change passwords, turn on two-factor authentication and watch your accounts.
  • You can check for free on Have I Been Pwned whether your email appears in known breaches.
  • Personal details in search results can be handled by sending removal requests to websites and search engines.
  • Opting out of one data broker doesn't stop the others, and your data may reappear as it's collected again.

Most people know their personal information is out there somewhere. Fewer realize how many places it shows up, or how differently each kind of exposure can affect them.

What is dark web exposure?

The dark web is a part of the internet that standard search engines don't index and that needs special software to access. It's commonly associated with illegal marketplaces, stolen credentials and leaked databases. When a company has a data breach, the stolen information (email addresses and passwords, phone numbers, sometimes financial details) often ends up sold or shared on dark web forums and marketplaces.

Dark web exposure is particularly concerning because it usually involves information that was never meant to be public. Unlike a social media profile or a public record, this data has been stolen. If your information appears on the dark web, one or more of your accounts may have been compromised at some point.

What dark web exposure can include

Dark web leaks commonly contain email and password combinations, Social Security or national ID numbers, and card or bank details. Medical records and private messages turn up too.

Why dark web exposure matters

Your information on the dark web raises the risk of identity theft, account takeover and targeted phishing. Data there can't be taken back, so early detection is what counts. The sooner you know, the sooner you can change passwords, turn on two-factor authentication and watch your accounts for anything odd. You can check for free whether your email shows up in known breaches on Have I Been Pwned.

Serus dark web alert for a data breach: leaked email, username and password flagged high risk, with recovery stepsExpand
A Serus dark web alert shows what leaked and the steps to secure the account.

What is surface web exposure?

The surface web is the part of the internet that's publicly accessible and indexed by search engines like Google and Bing. Surface web exposure happens when your personal information appears in search results: public directories, social media profiles, news articles, court records and other public pages.

It's the most visible type of exposure, yet people often overlook it. Few of us search our own name regularly. Over time, personal details pile up across many websites and add up to a surprisingly detailed profile of who you are.

What surface web exposure can include

Your full name, home address and phone number can all appear in surface web results. So can your work history, photos, legal records and even details about your family. Put together from several sources, this makes it easy for anyone (an employer, an old acquaintance or someone with bad intentions) to build a detailed picture of your life.

Why surface web exposure matters

Surface web exposure affects your reputation as well as your security. Someone can use public details about you for social engineering, gaining your trust with what they know and manipulating you into revealing more sensitive information. It can also affect job prospects and personal relationships. Because anyone with an internet connection can find it, it's one of the most immediate privacy problems for most people. For the search side of it, see how to remove search results about you from Google.

Serus surface web finding: a news article indexing a name and email, with an option to request removalExpand
A surface web finding in Serus: a news article showing a name and email, with the option to request removal.

What is data broker exposure?

Data brokers are companies that collect personal information and sell it. They pull data from public records, online activity, purchase histories, social media and surveys, and compile it into detailed profiles. Those profiles are sold to marketers, background check services and other buyers.

Most people have never heard of the data brokers that hold their information, yet many of them may have a profile on you. Sites like Spokeo, WhitePages, BeenVerified and many others operate in this space, and their business is knowing as much about you as possible.

What data broker exposure can include

A typical data broker profile holds your name, current and past addresses, phone numbers and email addresses. Many add your age, relatives, estimated income and property records, and some go as far as political affiliation and shopping habits. The depth varies by broker, but the combined picture across several brokers can be remarkably detailed.

Why data broker exposure matters

First, it happens almost entirely without your knowledge or consent. The US Federal Trade Commission found that brokers collect and sell this data behind the scenes, without consumers' knowledge. The data may come from technically public or permissible channels, but compiling and selling it raises real privacy concerns.

Second, this information is often used to make decisions about you, from the ads you see to whether you pass a background check, without your involvement.

Third, there are so many data brokers that removing your information is never a one-time task. Even after you opt out of one broker, your data may reappear as it's collected again or shared by others.

Serus data broker finding listing the home address, name and email a broker holds, with a Remove Exposure buttonExpand
A data broker finding in Serus lists the details the broker holds, with a button to remove the exposure.

How do the three types of exposure differ?

All three involve your personal information being available to others, but they come from different places and call for different responses.

Type of exposureWhere the data comes fromWhat to do
Dark webData breaches and criminal activity; stolen data traded in hidden placesAct right away: change passwords and secure your accounts
Surface webInformation that's technically public but harmful when easy to find or combinedSend removal requests to websites and search engines
Data brokerCollected legally, then compiled and sold in ways most people don't know about and wouldn't agree toOpt out of each broker one by one, which is tedious and never quite ends

Table: Dark web, surface web and data broker exposure compared.

Our guide on how to delete yourself from the internet walks through the manual route.

What can you do about your exposure?

Start by finding out where your information appears and in what form. Serus looks wherever your data shows up, including data brokers, people-search sites, public records and the dark web, and sorts what it finds into these three types, ranked by risk.

From there, you can deal with each item yourself or turn on Autopilot, which files removal requests for data brokers and other public sources automatically. Dark web and breach data can't be removed, so for those Serus alerts you and tells you what to secure.

Want to see where your information is exposed? Run a free scan.

Silver padlock and key ring on a light grey background, a visual nod to keeping your data locked downExpand

Questions

Can my information be removed from the dark web?

No. Data on the dark web can't be taken back, so early detection is what counts. Serus alerts you when your data appears and tells you what to secure.

What should I do if my email shows up in a data breach?

Change your passwords, turn on two-factor authentication and watch your accounts for anything odd. You can check whether your email appears in known breaches for free on Have I Been Pwned.

Where do data brokers get my information?

They pull data from public records, online activity, purchase histories, social media and surveys. They compile it into profiles that are sold to marketers, background check services and other buyers.

Why is personal information in search results a risk?

Someone can use known details about you to gain your trust and manipulate you into revealing more, which is called social engineering. Public information can also affect job prospects and personal relationships.

Author

Anthon Wansland

Head of Product & Co-Founder

Shapes the Serus product — from the first address-removal service to the platform it is today.

Reviewed by

Ida Nilsson

Related articles

All articles

Cookie preferences

Choose which categories we may use. Full details for every cookie are in our Cookie Policy.

Strictly necessary

Authentication, session management, security and fraud prevention, and saving your consent choice. Always active. The site cannot function without them.

Functional

Remember preferences such as language and settings that improve your experience.

Analytics

Help us understand how the site is used, like pages visited, interactions, and performance, so we can improve it.

Marketing & advertising

Measure our marketing and deliver more relevant ads through partners such as Google, Meta, TikTok, X, and Reddit. Used only with your consent.

Your choice is saved for 12 months and applies across serus.ai, including the app. You can change it anytime from the cookie widget or the "Cookie settings" link in the footer. Withdrawing consent does not affect processing that happened before withdrawal.