Into the Dark Web: the New Criminal Industry Living in the Internet's Shadows

A bounty on the personal data of a foreign minister, with a reward offered to anyone able to provide further information. That is what is happening in Italy to Antonio Tajani, who has been targeted by hackers along with other institutional figures, including Rome prosecutor Francesco Lo Voi and Ivano Gabrielli, head of Italy’s Postal Police.

The Rome prosecutor’s office has opened an investigation into the case, which may involve the pro-Russian group NoName057(16). But the Italian episode is just one of several drawing renewed attention to a phenomenon with international implications. The dark web — the part of the internet accessible through specific tools such as Tor — is not illegal in itself, but some of its spaces have become underground marketplaces for cybercrime. And the threat extends beyond passwords and bank accounts: personal information can become a tool for intimidation, blackmail and even political pressure.

The latest cases in the U.S.

In the United States, the FBI opened an investigation last September into the alleged sale on the dark web of millions of U.S. and Canadian driver’s licenses, after cybersecurity journalist Brian Krebs uncovered a database containing identity documents and personal information. Identity verification company IDScan.net later confirmed that it had suffered a data breach, while investigators continued to examine the extent of the exposure. In March, meanwhile, the U.S. Justice Department announced the takedown of LeakBase, one of the largest forums for buying and selling stolen data, with more than 142,000 registered users. The platform operated on the regular web, demonstrating that these illegal markets are no longer confined to hidden networks.

The new cybercrime industry

“The Dark Web in its criminal sense is nothing new, but the dynamics of how criminals use it are changing profoundly,” Pierluigi Paganini, cybersecurity expert and founder of Security Affairs, tells La Voce di New York . “In the past, it was mainly a place to buy and sell stolen data, credentials, malware and illegal services. Today, we are witnessing a true industrialization of cybercrime.”

The phenomenon is no longer limited to individual hackers stealing and reselling information. Instead, it involves a criminal division of labor, with each actor playing a specific role. Brokers sell access to corporate networks, groups organize ransomware attacks by locking systems or threatening to leak confidential information, and platforms connect buyers and sellers of illegal services.

The transformation was also highlighted in Europol’s April 2026 report, which describes an increasingly sophisticated criminal landscape, fueled in part by artificial intelligence. “It is an increasingly organized criminal supply chain, in which different actors collaborate without necessarily knowing one another,” Paganini says. A parallel economy has emerged, in which every piece of stolen information can have commercial value.

Data must be protected at all costs

The value of data is one of the most worrying aspects of the phenomenon. A stolen password, for example, could be used months later to access another account, particularly when the same credentials are reused. Personal information can fuel phishing campaigns, identity theft and financial fraud, while access to a company’s compromised network can be resold to another criminal group for use in a subsequent attack.

The danger can also extend to critical infrastructure and national security. Information that may appear harmless on its own can, when cross-referenced with other data, reveal details an organization’s activities and vulnerabilities. For Paganini, therefore, “the stolen data is not necessarily the ultimate objective of the attack: it can become the starting point for much more complex operations.” This also makes it difficult to identify everyone involved, since the person who steals the information may not be the one who eventually uses it.

The role of artificial intelligence

Artificial intelligence is making this system even more dangerous by allowing criminals to create more convincing scams, craft personalized messages, analyze large volumes of stolen data and reproduce the voices or images of real people. “Artificial intelligence is an important acceleration factor,” Paganini says, because it lowers the level of expertise and the resources required to carry out certain operations.

That does not mean attacks are now being conducted autonomously by machines. The human factor remains central, but tools once available only to criminals with advanced technical skills can now be used by a much wider pool of offenders. At the same time, AI can help companies detect anomalies and respond more quickly to intrusions.

For individuals and businesses, prevention remains essential: using different passwords, enabling multi-factor authentication, keeping devices updated and verifying suspicious communications through alternative channels, especially when money or sensitive information is requested. “Today, we can no longer trust only what we see or hear: even a familiar voice or an apparently authentic video can be generated or manipulated with AI,” the expert warns.

At the same time, he cautions against alarmism: “Finding your data on the Dark Web does not automatically mean that you were the victim of a recent attack.” The challenge, then, is not only to protect information before it is stolen, but also to prevent it from being reused — perhaps months later — to target individuals, companies and institutions all over again.