How illicit markets fueled by data breaches sell your personal information to criminals
- Written by Thomas Holt, Professor of Criminal Justice, Michigan State University
Every year, massive data breaches harm the public. The targets are email service providers, retailers and government agencies that store information about people. Each breach includes sensitive personal information such as credit and debit card numbers, home addresses and account usernames and passwords from hundreds of thousands – and sometimes millions – of people.
When National Public Data[1], a company that does online background checks, was breached in 2024, criminals gained the names, addresses, dates of birth and national identification numbers such as Social Security numbers of 170 million people in the U.S., U.K. and Canada. The same year, hackers who targeted Ticketmaster[2] stole the financial information and personal data of more than 560 million customers.
As a criminologist who researches cybercrime[3], I study the ways that hackers and cybercriminals steal and use[4] people’s personal information. Understanding the people involved helps us to better recognize the ways that hacking and data breaches are intertwined. In so-called stolen data markets, hackers sell personal information they illegally obtain to others, who then use the data to engage in fraud and theft for profit.
The quantity problem
Every piece of personal data captured in a data breach[5] – a passport number, Social Security number or login for a shopping service – has inherent value. Offenders can use the information in different ways[6]. They can assume someone else’s identity, make a fraudulent purchase or steal services[7] such as streaming media or music.
The quantity of information, whether Social Security numbers or credit card details, that can be stolen through data breaches is more than any one group of criminals can efficiently process, validate or use in a reasonable amount of time. The same is true for the millions of email account usernames and passwords, or access to streaming services that data breaches can expose.
This quantity problem has enabled the sale of information, including personal financial data, as part of the larger cybercrime online economy[8].
eg: In headline of the following chart, U.S. doesn’t need periods.
The sale of data, also known as carding[9], references the misuse of stolen credit card numbers or identity details. These illicit data markets began in the mid-1990s through the use of credit card number generators[10] used by hackers. They shared programs that randomly generated credit card numbers and details and then checked to see whether the fake account details matched active cards that could then be used for fraudulent transactions.
As more financial services were created and banks allowed customers to access their accounts through the internet, it became easier for hackers and cybercriminals to steal personal information through data breaches and phishing. Phishing involves sending convincing emails or SMS text messages to people to trick them into giving up[11] sensitive information such as logins and passwords, often by clicking a false link that seems legitimate.
One of the first phishing schemes[12] targeted America Online users to get their account information to use their internet service at no charge.
Selling stolen data online
The large amount of information criminals were able to steal from such schemes led to more vendors offering stolen data to others through different online platforms.
In the late 1990s and early 2000s, offenders used Internet Relay Chat[14], or IRC channels, to sell data. IRC was effectively like modern instant messaging systems, letting people communicate in real time through specialized software. Criminals used these channels to sell data and hacking services[15] in an efficient place.
In the early 2000s, vendors transitioned to web forums where individuals advertised their services to other users. Forums quickly gained popularity and became successful businesses with vendors selling stolen credit cards, malware and related goods and services to misuse personal information and enable fraud.
One of the more prominent forums from this time was ShadowCrew[16], which formed in 2002 and operated until being taken down by a joint law enforcement operation in 2004. Their members trafficked over 1.7 million credit cards[17] in less than three years.
Forums continue to be popular, though vendors transitioned to running their own web-based shops on the open internet and dark web, which is an encrypted portion of the web that can be accessed only through specialized browsers like TOR, starting in the early 2010s[18]. These shops have their own web addresses and distinct branding[19] to attract customers, and they work in the same way as other e-commerce stores. More recently, vendors of stolen data have also begun to operate on messaging platforms such as Telegram and Signal[20] to quickly connect with customers.
Cybercriminals and customers
Many of the people who supply and operate the markets appear to be cybercriminals from Eastern Europe and Russia[21] who steal data and then sell it to others. Markets have also been observed in Vietnam[22] and other parts of the world, though they do not get the same visibility in the global cybersecurity landscape.
The customers of stolen data markets may reside anywhere in the world[23], and their demands for specific data or services may drive data breaches[24] and cybercrime to provide the supply.
The goods
Stolen data is usually available in individual lots[25], such as a person’s credit or debit card and all the information associated with the account. These pieces are individually priced, with costs differing depending on the type of card, the victim’s location and the amount of data available related to the affected account.
Vendors frequently offer discounts and promotions[26] to buyers to attract customers and keep them loyal. This is often done with credit or debit cards that are about to expire.
Some vendors also offer distinct products such as credit reports, Social Security numbers and login details for different paid services. The price for pieces of information varies. A recent analysis[27] found credit card data sold for US$50 on average, while Walmart logins sold for $9. However, the pricing can vary widely across vendors and markets.
Illicit payments
Vendors typically accept payment through cryptocurrencies[28] such as Bitcoin[29] that are difficult for law enforcement to trace.
Once payment is received, the vendor releases the data to the customer. Customers take on a great deal of the risk[31] in this market because they cannot go to the police or a market regulator to complain about a fraudulent sale.
Vendors may send customers dead accounts that are unable to be used or give no data at all. Such scams are common in a market where buyers can depend only on signals of vendor trust[32] to increase the odds that the data they purchase will be delivered, and if it is, that it pays off. If the data they buy is functional, they can use it to make fraudulent purchases or financial transactions for profit.
The rate of return can be exceptional[33]. An offender who buys 100 cards for $500 can recoup costs if only 20 of those cards are active and can be used to make an average purchase of $30. The result is that data breaches are likely to continue[34] as long as there is demand for illicit, profitable data.
This article is part of a series on data privacy that explores who collects your data, what and how they collect, who sells and buys your data, what they all do with it, and what you can do about it.
References
- ^ National Public Data (support.microsoft.com)
- ^ who targeted Ticketmaster (www.rollingstone.com)
- ^ researches cybercrime (scholar.google.com)
- ^ steal and use (www.doi.org)
- ^ captured in a data breach (www.hipaajournal.com)
- ^ different ways (doi.org)
- ^ steal services (doi.org)
- ^ cybercrime online economy (www.gasa.org)
- ^ also known as carding (www.investopedia.com)
- ^ credit card number generators (www.lambdatest.com)
- ^ trick them into giving up (consumer.ftc.gov)
- ^ first phishing schemes (www.historyofinformation.com)
- ^ U.S. Federal Trade Commission (consumer.ftc.gov)
- ^ Internet Relay Chat (www.radware.com)
- ^ sell data and hacking services (www.tuscaloosanews.com)
- ^ ShadowCrew (darknetdiaries.com)
- ^ over 1.7 million credit cards (www.justice.gov)
- ^ in the early 2010s (krebsonsecurity.com)
- ^ distinct branding (krebsonsecurity.com)
- ^ Telegram and Signal (cybersecuritynews.com)
- ^ Eastern Europe and Russia (doi.org)
- ^ observed in Vietnam (doi.org)
- ^ reside anywhere in the world (krebsonsecurity.com)
- ^ drive data breaches (krebsonsecurity.com)
- ^ individual lots (www.scworld.com)
- ^ discounts and promotions (cybersixgill.com)
- ^ recent analysis (blog.knowbe4.com)
- ^ cryptocurrencies (www.investopedia.com)
- ^ Bitcoin (doi.org)
- ^ AP Photo/Charles Krupa (newsroom.ap.org)
- ^ take on a great deal of the risk (www.scworld.com)
- ^ signals of vendor trust (doi.org)
- ^ can be exceptional (doi.org)
- ^ data breaches are likely to continue (threatpost.com)
Authors: Thomas Holt, Professor of Criminal Justice, Michigan State University
