How much is your stolen personal data worth?

Some cybercrime-as-a service pricing is revealed in a new study.

Examples of the different kinds of personal data available online, as well as its value on the black market, is available in a new report (PDF) from Intel Security's McAfee Labs. The report looks at pricing for credit cards, bank account login details, and other stolen personal information.

$5 credit card numbers

U.S. credit card account numbers complete with date of birth typically run $15, the report says. Basic card numbers without the extra data costs as little as $5.

"A digital equivalent of physical card would let a criminal buy things until the victim contacts the card issuer and challenge the charges," Raj Samani, CTO for Intel Security in Europe, the Middle East, and Africa, said in a McAfee blog post about the report.

Payment service accounts

Personally Identifiable Information (PII) pricing becomes higher for payment service accounts, and it varies depending on how much is in the account, the study found.

Login credentials for accounts with amounts ranging from $400 to $1,000 are estimated to cost between $20 and $50. That rises to $200 to $300 for flush accounts in the $5,000 to $8,000 range, according to the report.

All of the compromised data is found on the dark web.

Premium content services

If you were a baddie and decided that plonking down $300 for someone's payment service account was a bit steep for you, all is not lost. Login credential for services, such as online video streaming, cost from 55 cents to a dollar.

Premium cable channels, however, are a bit more. They cost $7.50, and professional sports streaming video-watching credentials come in at $15, the report says. 

Loyalty accounts

Surprisingly, some loyalty accounts commanded top dollar. Hotel accounts with 100,000 points were available for $20. The reason: a buyer can conduct other fraudulent online transactions with the details.

One shocker was how valuable an online auction account with high reputation marks can be. The report says those accounts can fetch as much as $1,400 each.

Credentials for premium-content services, enterprise networks, hospitality loyalty accounts, and online auction accounts were among the valuable personal data detailed in the report.

Other sources

McAfee, however, isn't the only security outfit that has studied this area. Trend Micro recently analyzed data breach-sourced data and found Uber accounts available for $1.15 and scans of driver's licenses and utility bills fetching $10 to $35.

I wrote about Trend Micro's report in "More data breaches caused by lost devices than malware or hacking."

Trend Micro's report says that prices for PII are dropping. The likely reason is that there's now a glut of PII out there—the thieves have been too successful.

Sell your own data

One question, however, that all of this dark web commerce data raises is just why we can't we benefit from our data. In other words, how come it's the criminals who are making the money? It's our data, after all.

Can't we sell our own data? Well, the answer is that you actually can sell some of it. I'll write about that in another article, soon.


Copyright © 2015 IDG Communications, Inc.

The 10 most powerful companies in enterprise networking 2022