A cybercriminal group known as ShinyHunters claimed to have hacked the FBI and leaked millions of sensitive data through the agency's job portal, FBIJobs.gov. The data reportedly includes names, addresses, phone numbers of many agents and their spouses, as well as their assignments, including those within the FBI's secret hacker unit. If the leak is confirmed, it could be a "disaster for counterintelligence," according to Justin Sherman, a professor at Georgetown University and an expert in American national security. Thousands of agents could be exposed to profiling, phishing, and approaches by foreign intelligence services. The leak could also signal more leaks, as stolen data often ends up being sold or exchanged on the dark web. Monitoring these activities allows anticipation of potential new cyberattacks. Cybercriminals often prefer to attack targets using valid credentials rather than facing multiple security measures like firewalls, antivirus, multifactor authentication, and strong passwords. This method is faster and leaves fewer traces. These credentials are often stolen by infostealers, malicious software designed to discreetly steal passwords, auto-fill data, or browser cookies on a computer. It only takes a click on a malicious link to install them. The infected computer does not have to belong to the targeted company, as those of some suppliers or vendors provide the same entry points. According to Fortinet, 1.7 billion stolen credentials were shared on clandestine forums in 2024, and the number of logs from detected infostealers on these platforms had increased by 79 percent the following year. The dark web is not a forbidden zone and accessing it is allowed in France, via specialized browsers such as Tor. It hosts both criminal activities and legal ones. Stolen data are traded there, often at an affordable price. A credit card number can be found there for as little as 5 euros, bank account credentials for an amount between 35 and 65 euros, and a verified cryptocurrency account for a few hundred euros. That is barely more expensive than the cost of launching a DDoS attack (available from 20 euros on the dark web). Before being launched, a cyberattack is prepared, and weak signals are visible on the dark web. The credentials of the company that will be targeted - or its suppliers - resurface, and access to its network is offered for sale. For professionals who know how to read them, these indicators are as many alerts that warn of an imminent attack. Once identified by cyber threat monitoring tools that scan the dark web, and by dedicated analysts, these signals allow alerting the company, which must then act quickly to change passwords, close open sessions, and warn the affected suppliers of the identified vulnerabilities. While the best-protected organizations on the planet are being hacked and the latest models of large language models pose new threats to data, a simple dark web monitoring can prove to be more effective and much more cost-effective than you might imagine.