My info ended up on the dark web. Now I always use these 6 tools to protect my identity 

I didn’t always take online security seriously. I made basic mistakes, like using the same password for all my accounts, logging onto public WiFI networks without a VPN and giving out my email and phone number to anyone who asked.

After putting it off for a while, I finally enrolled in Capital One’s CreditWise credit monitoring service last year. Within a few minutes, I got a notification that my email address, multiple passwords and at least one previous home address were circulating on the dark web, a hidden part of the Internet that’s a haven for cybercriminals.

I felt exposed. Someone (or, more probably, someones) had my data and could use it to commit identity theft or fraud. Information on the dark web isn’t linked to standard search engines and requires specialized software to access. If your personal details end up there, it’s next to impossible to get them removed. 

Before that incident, I didn’t think too much about cybersecurity. I mean, who would target me? I’m not exactly high profile.

The truth is, it’s not about who you are; it’s about how easy it is to access your information. If you go to work and leave the front door open, it’s an invitation to thieves — whether you live in a mansion or a double-wide.

According to the FBI, Americans lost a reported $16.6 billion to cybercrime in 2024, a 33% increase from the year before. Thankfully, I strengthened my internet security before anyone used my personally identifiable information (PII). But it was the wake-up call I needed.

After getting that notification, I added these six steps. It took less than a day to set them all up — certainly less time than I’d need to restore my identity and financial accounts.

When you apply for a loan, lenders pull your credit history to see how much of a risk you pose. I’m not planning to apply for any new credit cards or loans, so I keep my credit reports frozen. I’m telling lenders I don’t want any new lines of credit, and if they receive a request from me, it’s likely counterfeit. 

Freezing your credit isn’t difficult, but it does require a few steps. You can do it manually, like I did, by logging onto the three major credit bureaus – Equifax, TransUnion and Experian — and finding the appropriate page.

Some of the better identity theft protection services, like LifeLock and IdentityForce, offer a one-touch credit freeze that covers all three bureaus. 

Like many people, I fell into the habit of using the same password for everything. After my information was exposed, though, I created unique passwords for everything — email, banking, streaming services, gaming, retail sites — and increased their complexity by adding numbers, symbols and both uppercase and lowercase letters.

This year, I upgraded to a password manager that generates unique random passwords for me and stores them securely. I use Aura, which also provides email aliases and alerts you if your passwords are compromised. In addition to a password manager, Aura comes with a VPN, antivirus programs and other ID theft protection tools. 

With multi-factor (or two-step) authentication, you have to confirm your identity with more than one form of identification. You may be asked to provide a password online, then confirm a code sent to your phone or email.

I’ve added MFA to all the platforms that let me, including Gmail, my banking app and even my PlayStation and Steam accounts.  

The process varies by the service — it might involve an authenticator app, text message or bioscan — but it makes it harder for cybercriminals to walk in your front door.

Hackers often use viruses, spyware, keyloggers and other malware to steal our information. According to the Federal Trade Commission, reports of malware discoveries skyrocketed by more than 70% between 2022 and 2024.

Good antivirus software can block a lot of malware. Historically, I used free versions like McAfee Antivirus and Malwarebytes. They’re fine, but given the fright I got, I ponied up for Avira Security. It continually polices my systems, checks for security flaws and lets me scan a file before I download it. It also includes a VPN, password manager and phishing blocker.

A virtual private network obscures your computer’s IP address, hiding your real location from people who don’t need to know it. It also makes it harder for cybercriminals to view your browser history and personal data. 

I use Private Internet Access, which conceals my information with a single click. My username is also randomly generated, so there’s no association with any of my PII. I can even choose the state I want my IP to appear to be coming from.

Social media is an easy way for cybercriminals to glean details about you, so I stopped sharing my birthday and pictures of my family on Facebook and Instagram. I don’t give out my email to get discounts or share any information about my physical location. I don’t talk about the street I grew up on, my first pet’s name or any other details that may appear on a security question.

You can set your own parameters, but it’s a good idea to limit how much information you share about yourself and your loved ones. Ask yourself: “Could this be used to guess a password or access one of my accounts?”

If the answer is yes, don’t share it.

At CNBC Select, our mission is to provide our readers with high-quality service journalism and comprehensive consumer advice to help them make informed financial decisions. Every cybersecurity article is based on rigorous reporting by our team of expert writers and editors. While CNBC Select earns a commission from affiliate partners on many offers and links, we create all our content without input from our commercial team or any outside third parties, and we pride ourselves on our journalistic standards and ethics.

Catch up on CNBC Select’s in-depth coverage of credit cards, banking and money, and follow us on TikTok, Facebook, Instagram and Twitter to stay up to date.