What’s Your Personal Data Worth On The Dark Web?

It's an inevitability of the modern world that your personal information is going to be compromised at some point and you'll have to go through the hassle of changing your password or account number or signing up for credit monitoring.

For victims it's a headache, but it generally doesn't extend beyond that. For the cybercriminals, though, it can be a wildly lucrative venture.

But how do hackers sell your stolen data, and who is willing to buy it? Thomas Holt, an associate professor of criminal justice at Michigan State University, recently conducted a study with some colleagues examining the strategies used by individuals operating in the real world for stolen goods in virtual illicit markets that are hidden from the public, specifically, the dark web. This clandestine marketplace is a heavily encrypted underground world within the internet, and it is difficult for authorities to detect the location or owners of the data markets within the dark web.

Funded by the National Institute of Justice, Office of Justice Programs and US Department of Justice, Holt and his colleagues analyzed posts from 10 Russian- and three English-language web forums selling stolen data to engage in identity theft and fraud.

The study found that most of the sellers on the dark web advertise their data and services in forums much like an Amazon or eBay, where buyers and sellers rate each other and the quality of their products being sold, in this case, personal information. While it sounds lawless, there's an honor amongst data thieves. Buyers of stolen data pay first and trust it will be delivered.

Holt claims it is hard to put an exact figure on what hackers are getting for stolen data, for several reasons: Cash transactions tend to be on the rare side in these sorts of transactions, bulk discounts take place for big data scores, and precise negotiations take place via email or private online chat. Yet it appears bitcoin and other web-based currencies are the norm, because the sources are much harder to trace.

What Holt and his colleagues found was that of the 320 transactions they studied, data sellers earned between $1 million and $2 million. Similarly, buyers in 141 of these transactions earned between $1.7 million and $3.4 million through the use of the information they purchased.

How much is your data worth?

So how much is your data worth? It varies, sometimes tremendously, on where it's being sold. To get the broadest possible look at what hackers are buying and selling these days, CNBC.com reached out to several security experts. The prices stolen data is commanding ran the gamut.

According to Michal Salat, threat intelligence manager at Avast Software, an IT security company that develops antivirus software, data is not worth that much individually. Avast focuses on commonly stolen personal data, such as Social Security and credit card numbers.

"The price increase [per account/credit card number] usually isn't linear," says Salat. "A lot of sellers have discounts for higher credentials counts and for regular customers."

Here is what Avast claims data sellers are fetching for the following:

  • Credit cards without a balance guarantee: $8 per card (number and CVV)
  • $2,000 balance guarantee: $20 per card (number and CVV)
  • Driver's license scans: $20
  • Email addresses and passwords: $0.70–$2.30
  • Social Security numbers: $1 ($1.25 for state selection)
  • PayPal credentials/access: $1.50

Beyond the financial data

Yet some thieves are interested in more than just financial data. Some are looking for access to something as mundane as entertainment services or as significant as logins to national services (via FTP or SFTP — file-transfer protocols that allow users to transfer files between computers).

The high prices for .GOV accounts might seem surprising, but Ed Cabrera, chief cybersecurity officer at Trend Micro, says the access they provide commands top dollar.

"These stolen credentials enable criminals to compromise servers to steal data or otherwise launch secondary attacks," he says. "The criminal underground operates on supply and demand so the same market forces we see on surface web you can see in the deep web."

Here are what security software company Trend Micro claims this type of data is commanding today:

  • Credit card credentials: $15-$22
  • Spotify account: $2.75
  • Hulu account: $2.75
  • Netflix account: $1–$3
  • NOAA.gov account (FTP or SFTP access): $476
  • USPS.gov account (FTP or SFTP access): $680
  • CDC.gov account (FTP or SFTP access): $340
  • Western Union account: $6.80

CNBChttp://cnb.cx/2aRwXZS

« Risky Business: Desktop Banking Declines As Users Switch To Apps
Too Much Information: Making Sense Of Big Data »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

TÜV SÜD Academy UK

TÜV SÜD Academy UK

TÜV SÜD offers expert-led cybersecurity training to help organisations safeguard their operations and data.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Oracle Cloud Security

Oracle Cloud Security

Oracle’s cloud security solutions enable organizations to implement and manage consistent security policies across the hybrid data center.

Mako Networks

Mako Networks

The Mako System is an award winning networking and security service designed specifically for SMEs and branch offices of larger organisations.

Morphus Information Security

Morphus Information Security

Morphus is an information security company providing Red Team, Blue Team and GRC services as well as conducting research in cybersecurity and threat analysis.

TechBeacon

TechBeacon

TechBeacon.com is a digital hub by and for software engineering, IT and security professionals sharing practical and passionate guidance to real-world challenges.

Liquid Technology

Liquid Technology

Liquid Technology provide DOD- and NIST-compliant data destruction and EPA-compliant e-waste disposal and recycling services throughout North America, Europe and Asia.

SafeGuard Cyber

SafeGuard Cyber

The SafeGuard Cyber SaaS platform empowers enterprises to adopt the social and digital channels they need to reach customers, while reducing digital risk and staying secure and compliant.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Timus Networks

Timus Networks

Timus Networks enables today's work from anywhere organizations to secure their networks very easily and cost effectively.

Aceiss

Aceiss

Aceiss empowers access security, providing unprecedented visibility and insights into user access.

GoTo

GoTo

At GoTo we help people and businesses to connect and collaborate simply and securely – from anywhere. We’re the trusted partner for companies of all sizes.

Dimension Data

Dimension Data

Dimension Data is a leading African born technology provider operating in the Middle East and Africa, offering a portfolio of services including intelligent security solutions.

Positka FSI Pte Ltd

Positka FSI Pte Ltd

Positka, being a Splunk Singapore partner, provides Splunk & Phantom Services, Cybersecurity & Risk Management, Analytics & Big Data, Lean Process Optimization, and Managed Security Services.

Cyber Industrial Networks

Cyber Industrial Networks

Cyber Industrial Networks objective is to service the needs of industry in achieving reliable, robust and secure infrastructure that supports productivity.

Leo CybSec

Leo CybSec

Leo CybSec unites a group of Cyber Security experts with 20+ years of collective expertise to help our clients realise and mitigate the cyber challenges and risks facing their business.

Cloudbox

Cloudbox

Cloudbox build and maintain a highly secure, compliant IT infrastructure for our clients – with total peace of mind – so they can focus on the market.

OOKOS

OOKOS

OOKOS was founded in 2023 by a team of cybersecurity veterans who recognized that traditional security models were failing to keep pace with evolving threats.