Norton Lifelock alerts

[BetsyR_Blackley]

Norton alerts you to a dark web activity. They can’t tell you a website. They give you a username and a password that you have NEVER used. You chat with someone and cannot get any information except to change your password. If I KNEW the website, I would change the password. Then they cut you off…..

[bjm]

@BetsyR_Blackley

Norton alerts you to a dark web activity. They can’t tell you a website. They give you a username and a password that you have NEVER used. You chat with someone and cannot get any information except to change your password. If I KNEW the website, I would change the password. Then they cut you off…..

Hello @BetsyR_Blackley

I understand why you’re frustrated.
Norton does document a category of Unattributed alerts where the source website may be unknown, no longer exist, or cannot be mapped to a specific site.
In those cases, Support may not have a website to provide.

======

Your complaint is fairly common with dark web monitoring services, not just Norton LifeLock.:

“You told me a credential was found, but you won’t tell me where it came from, and the username/password combination isn’t even recognizable to me.”

There are a few possible explanations:

• The credential may have come from a large breach dataset where the original website is unknown, unavailable, or not disclosed by the data provider.
• The username could be an old email alias, typo, or account identifier the user forgot about.
• The password shown may not be the complete password. Some monitoring services partially mask or transform credentials when reporting them.
• The data may originate from credential-stuffing collections (“combo lists”) assembled from many breaches rather than a single website breach.

If the Dark Web Monitoring alert does not identify the affected website or service, Norton Support generally has access only to the information displayed in the alert. In some cases the breach source is not available from the data provider, so Support may be unable to identify the website. If the username, email address, or password shown in the alert is not recognizable, review any accounts that may have used similar credentials in the past and ensure that important accounts use unique passwords and MFA. Unfortunately, if the breach source is not included in the alert, Support may not be able to provide additional details.

======

According to Norton’s support article on Dark Web Monitoring, alerts can be either:

• Attributed — Norton knows the source website or breach.
• Unattributed — the exposed data belongs to a site that no longer exists, is unknown, or cannot be mapped to a specific site.

That means Norton is essentially acknowledging that some alerts will not include a website name because the source cannot be reliably identified.

Norton also has an FAQ entry titled:

“I don’t recognize the website or the password in the notification. How do I know I have used this before?”

Unfortunately, the public FAQ page is mostly an interactive help page and doesn’t expose the full answer in the search result, but the existence of that question suggests Norton recognizes that users frequently receive alerts involving:

• websites they don’t recognize,
• passwords they don’t recognize,
• or credentials that appear unfamiliar.

So when the Community user says:

“They can’t tell you a website.”

Norton’s documentation would essentially respond:

Sometimes we can, sometimes we can’t. Some alerts are “Unattributed” because the breach source is unknown, no longer exists, or isn’t mapped to a specific site.

Whether that is satisfying to the user is another matter. The user’s frustration seems to be:

“If you can’t tell me what account is affected, how am I supposed to change the password?”

And Norton doesn’t appear to offer a way to obtain additional source information when an alert is categorized as Unattributed. The guidance remains to review accounts using similar credentials and update passwords where applicable.

In other words, the Community complaint is largely about the practical usefulness of an Unattributed alert, and Norton’s own documentation confirms that such alerts do occur.

======

You may receive alerts or notifications that are either Attributed, which means the site of the breach is known, or Unattributed, meaning that the exposed data belongs to a site that no longer exists, is unknown or is not mapped to any site.

Some alerts are Unattributed, meaning Norton’s data source cannot reliably associate the exposed credential with a known website because the site is unknown, no longer exists, or cannot be mapped to a specific site.

• Dark Web Monitoring
• Dark Web Monitoring - FAQs
• Notifications About Information Found on the Dark Web
• Updating your financial accounts, mailing address, and other personal information for Dark Web Monitoring

Support may appear unhelpful if the alert is Unattributed, the support representative may literally have no website information available beyond what the user already sees in the alert. In that situation, they often fall back to generic advice such as:

• Change passwords on important accounts.
• Ensure passwords are unique.
• Enable MFA where available.
• Monitor accounts for suspicious activity.

From the user’s perspective, that can feel like:

“You found a problem but won’t tell me where it is.”

But from Norton’s perspective, the underlying breach data may simply not contain a reliable source site.

The other clue in that Community post is the complaint that the username and password were ones the user had “never used.” That is also consistent with unattributed or very old breach data, aliases, typos, recycled credentials, or data that the user no longer recognizes years later.

So after reading Norton documentation, the Community complaint becomes less a case of Norton withholding information and more a case of Norton not having enough source information to provide. Whether that makes the alert useful is a separate question, but the documentation does explain the limitation.

Norton states that Dark Web Monitoring alerts may be either Attributed (source website known) or Unattributed (source website unknown, no longer exists, or cannot be mapped to a specific site). In the case of an Unattributed alert, Norton may not have a website available to provide. Norton support article appears to explain why some alerts do not identify a source site.

======

Norton support article on Dark Web Monitoring explains that alerts may be either Attributed or Unattributed. For Unattributed alerts, Norton states that the exposed data may belong to a site that is unknown, no longer exists, or cannot be mapped to a specific site. That appears to explain why some users receive an alert without a website being identified and why Support may not have additional source information available.

[bjm]

Hello @BetsyR_Blackley

[bjm]

Hello @BetsyR_Blackley