Marketplaces that sell illicit goods on the dark web come and go: The FBI shut down the notorious Silk Road market in 2013, and a set of coordinated raids in 2014 took down 400 dark-web markets hosted in 17 different countries. That’s a small slice of all the sites on the dark web, but these fluctuations make it difficult to monitor the most active marketplaces—so to help its spider out, Terbium’s employees  are also on the lookout for new sites in need of indexing.

Once Matchlight has an index of what’s being traded on the Internet, it needs to compare it against its clients’ data. But instead of keeping a database of sensitive and private client information to compare against, Terbium uses cryptographic hashes to find stolen data.

Hashes are functions that create an effectively unique fingerprint based on a file or a message. They’re particularly useful here because they only work in one direction: You can’t figure out what the original input was just by looking at a fingerprint. So clients can use hashing to create fingerprints of their sensitive data, and send them on to Terbium; Terbium then uses the same hash function on the data its web crawler comes across. If anything matches, the red flag goes up. Rogers says the program can find matches in a matter of minutes after a dataset is posted.

When a client gets an alert from Terbium that their sensitive data has turned up someplace it shouldn’t be, their next move depends entirely on the kind of data that was stolen. If it’s customer financial data, the client might offer a year of free identity-fraud protection services to the affected individuals; if it’s passwords, the organization might force all its users to create new ones.

Hackers and criminals appear to be getting busy: Rogers says Matchlight sends clients thousands to tens of thousands of alerts every day. And while getting an alert means the damage has already been done—you can’t put the data back in the box once it’s out—speedy notifications can keep a company from reading about their own data breach on the morning news.