As high profile data breaches dominate the news, the hidden economy driving these crimes is rarely discussed. Stolen personal data is the focal point of an online marketplace susceptible to the same influences as other economies, including price fluctuations based on supply and demand, differing price tiers based on quality and specialty suppliers.  

According to this report from McAfee, the price of stolen credit card information is contingent on the additional information that is provided with the credit card number. If the card number is provided with the user’s date of birth, the price almost doubles. Information such as the victim’s full name, billing address, social security number and mother’s maiden name, a ubiquitous piece of information for many online security checks, will further raise the price of a stolen credit card number. Prices also vary based on the location of the card holder and the balance available on the card. According to the report, a credit card number with a card verification code, from the United states, costs approximately $15 to purchase, whereas the additional info listed above would raise the price to $30. The report also states that “full banking services, especially those with the ability to transfer funds to US banks…sell for about 8% of the balance.”

In light of numerous high profile data breaches and the repeated targeting of financial institutions, there are more security provisions in place to prevent banking and credit fraud than there have ever been. Criminals are turning their sights to other lucrative sources of personal data such as the medical industry. Health records have become a prominent target for cyber criminals because of the large volume of valuable data that can be extracted in a single breach, including birth dates and Social Security numbers which could be repurposed for identity theft. Additionally, the industry’s reliance on outdated computer systems makes it more vulnerable than other targets such as banks. Brian Krebs has previously reported on some of the common uses for stolen medical data, from “fraudulently opening new lines of credit to filing phony tax refund requests with the Internal Revenue Service. Last year, a great many physicians in multiple states came forward to say they’d been apparently targeted by tax refund fraudsters, but could not figure out the source of the leaked data. Chances are, the scammers stole it from hacked medical providers like PST Services and others.” According to Reuters, “Stolen health credentials can go for $10 each.  A study from the Ponemon Institute, a research center dedicated to data protection, found that “victims of medical identity theft can suffer significant financial consequences. Sixty-five percent of medical identity theft victims in our study had to pay an average of $13,500 to resolve the crime.” 

As the popularity of online gaming increases, gamers are also becoming a lucrative target for cyber criminals. Online gaming accounts are typically connected with users’ credit card details to enable in-game purchases. Additionally, some games require the player to spend significant amounts of time developing their online characters and successful characters can sometimes be sold for thousands of dollars. Both the credit card details and in-game content are forms of currency which make cyber-attacks against gaming networks a lucrative endeavor. Some people simply want to purchase access to a successful character or online gaming account instead of putting in their own work. According to this post from Dark Reading,  “Whether you want to read some comic books ($0.55), watch online video (up to $1), get access to premium cable channels ($7.50), or watch live professional sports ($15), stolen login credentials are readily available.”