New Report Exposes Prices for Stolen Data on the Dark Web

October 15, 2015, Written By John H. Oldshue
unlock security lock on computer circuit board - computer security concept

Today, Intel Security released The Hidden Data Economy Report, which details how stolen data is packaged for sale and how much it garners on the black market. The McAfee Labs division of the company explored the pricing for:

  • Stolen credit and debit cards
  • Bank account login credentials
  • Stealth bank transfer services
  • Online payment service login credentials
  • Premium content service login credentials
  • Hospitality loyalty account login credentials
  • Online auction account login credentials

To compile the data for the report, the McAfee Labs team worked with IT security vendors and law enforcement. They also examined numerous online communities where stolen data is bought and sold.

Payment Cards
Payment card data is the most common type of data that is stolen. Within this overall category, though, there is a hierarchy of how the data is packaged, priced and sold. The most common package includes a software-generated number that provides an account number, an expiration date and a CVV number.

The price increases if a bank account number and date of birth are included. The most valuable package includes what is called “Fullzinfo” information, which contains a billing address, PIN number, social security number, date of birth, mother’s maiden name and username and password access. The average price for these packages in the United States are:

  • Basic: $5-$8
  • With bank account number: $15
  • With date of birth: $15
  • With Fullzinfo: $30

Payment Service Accounts
The price for these accounts depends on the account balance. If the login credentials link to an account that contains a balance of $400 to $1,000, the cost will range between $20 and $50. If the account contains $5,000 to $8,000, the cost will rise to $200 to $300.

Bank Logins
These accounts are the most valuable. The login credentials for an account with a balance of $2,200 costs $190. If the account allows cybercriminals to easily transfer stolen funds across international borders, the price goes up to $1,200 (for a $500 balance) to $6,000 (for a $20,000 account balance).

Online Premium Content
Criminals are even buying login credentials for content such as online video streaming (like Netflix), which earns $0.55 to $1, premium cable channel streaming services (like HBOGo), which costs $7.50, comic book services ($0.55), and professional sports streaming ($15).

Loyalty Accounts
While it would seem as if a hotel loyalty program or online auction account would have limited value to cybercriminals, this information is still offered on the dark market, since these accounts let buyers make online purchases. Researchers found that a hotel brand loyalty account with 100,000 points will sell for $20.

“Like any unregulated, efficient economy, the cybercrime ecosystem has quickly evolved to deliver many tools and services to anyone aspiring to criminal behavior,” Raj Samani, chief technology officer for Intel Security EMEA, said in a statement. “This ‘cybercrime-as-a-service’ marketplace has been a primary driver for the explosion in the size, frequency and severity of cyber attacks.”

In addition to all of this data, cybercriminals also purchase products that make it easier for them to obtain data themselves. These programs are responsible for “fueling a number of infections across the world.”

Since there are nearly daily reports of data breaches, consumers are starting to feel ‘data breach fatigue,’ or apathy. McAfee said it hopes this report encourages consumers to become more concerned about breaches and take measures to reduce their chances of becoming a victim.

The information contained within this article was accurate as of October 15, 2015. For up-to-date
information on any of the terms, cards or offers mentioned above, visit the issuer's website.