How Breach Data Gets Sold on Criminal Markets

In April 2021, RaidForums hosted the public release of a database with personal information for 533 million Facebook users across 106 countries. At the time, RaidForums was the largest English-language hacking forum by active membership. The data included phone numbers, full names, locations, birthdates, and email addresses. It had been scraped from Facebook using a contact importer feature in 2019. Facebook’s response when journalists reported it: this was “old data” and the “vulnerability was found and fixed in August 2019.” That statement was narrowly true and broadly useless. The dataset was freely available for download within hours. Within days, independent researchers had built a lookup tool so anyone could check whether their phone number was in it. The data remains in circulation. RaidForums itself was seized and shut down by the FBI in April 2022 — but the dataset has since appeared on its successors, repackaged, recombined, and still usable.

The Facebook leak is not unusual. It is typical. What makes it instructive is its scale and the clarity of the market’s response. It also shows the gap between what companies say about old breaches and what actually happens to the data afterwards.

The short answer: After a breach, stolen data moves through a commercial pipeline. It’s validated, graded, and priced on structured dark-web markets. Email and password pairs sell for cents, credit cards for $5–35, “fullz” identity packages for $15–40, and medical records for $20–100. Data cascades from top buyers down to free combo lists, staying usable for years. Stealer-log markets add a real-time layer of freshly stolen credentials. Market takedowns disrupt but don’t erase copies already sold. Your best defence is unique passwords, breach alerts, and transaction monitoring.

In this article:

How do the markets operate?

Dark web markets for stolen data are not shadowy, disorganised IRC rooms. They are commercial platforms with customer support, dispute resolution systems, searchable databases, and structured reputation mechanisms. The well-documented forums include RaidForums (seized April 2022), BreachForums (seized March 2023, relaunched, seized again in May 2024), Exploit.in (still operating as of writing), and XSS.is (a Russian-language forum, also still active). These are indexed databases, not information dumps. Sellers list data with sample records for verification, describe the breach source and date, and set pricing in cryptocurrency, typically Monero or Bitcoin.

Vendors build reputations across dozens of transactions. Bad data — samples that fail validation, card numbers that have already been cancelled, email lists that bounce at high rates — generates negative reviews and tanks a seller’s standing. Verified, fresh data from sellers with established track records commands significant price premiums. The mechanics are meaningfully similar to any e-commerce marketplace, which is precisely what makes them effective.

Genesis Market, before Europol’s “Operation Cookie Monster” seizure in April 2023, was one of the most sophisticated examples. Genesis didn’t just sell usernames and passwords — it sold complete browser fingerprints. A Genesis “bot” was a packaged collection of browser session cookies, saved credentials, and device configuration data extracted from a victim’s machine by infostealer malware. Buyers could import a Genesis bot into a browser plugin and impersonate the victim’s browsing session: same device fingerprint, same cookies, same active authenticated sessions. Logging in as someone without knowing their password, because you’re presenting as their device. That’s qualitatively different from a credential list.

How is data graded and priced?

Before data reaches market, it is typically validated. Automated tools check whether email addresses are live and whether passwords still authenticate against targeted services (credential stuffing validation). They also check whether credit card numbers pass the Luhn algorithm and return valid Bank Identification Numbers. Freshness and validation status drive pricing.

The price ranges below are drawn from Experian’s annual Dark Web Price Index, Trustwave SpiderLabs research, and Flashpoint threat intelligence reports — all publicly published:

Email address and password pairs: $0.01–0.10 per record in bulk. This is commodity data. Hundreds of billions of email/password combinations are in circulation from years of accumulated breaches. Volume discounts apply; a list of one hundred million unvalidated combinations might sell for hundreds of dollars.

Email address, phone number, and full name: $0.50–2.00 per record. More useful for targeted phishing and SIM-swapping attacks, where knowing a victim’s phone number is necessary.

Credit card with CVV (UK domestic or US domestic): $5–20 per card, depending on the card’s credit limit, the issuing bank, and how recently the data was obtained. Cards near or above a $10,000 limit sell at the high end.

Credit card with CVV (European or UK international-use card): $20–35 per card. European cards historically achieve better fraud bypass rates due to differences in how merchants in certain regions handle card-not-present transactions.

“Fullz” — a complete identity package including Social Security number, date of birth, address, driver’s licence number, and bank account details: $15–40 per identity. Used to open fraudulent accounts, apply for credit, or submit false tax returns.

Medical records: $20–100 per record, making them among the highest-value data categories per record. Medical data is used for insurance fraud — submitting claims for procedures that didn’t happen — and for prescription drug fraud. Medical records also contain enough personal detail to make identity theft straightforward.

Corporate network access sold by initial access brokers: $100 to $25,000 or more. Price depends on the company’s size, sector, the level of access obtained, and whether it includes domain administrator credentials. An initial access broker doesn’t run the intrusion themselves. They sell the foothold to ransomware operators or espionage groups who conduct the larger attack.

The grading process also distinguishes “combo lists” — email and password pairs that have been pre-validated against specific services (Netflix, Spotify, PayPal, banking portals) — from raw unvalidated dumps. Validated combo lists command a significant premium because the checking work is already done. Some criminal services offer checking-as-a-service: submit a raw credential list, pay a fee, receive back only the pairs that successfully authenticated.

The resale cascade

A breach database doesn’t get used once and discarded. It cascades.

First-wave buyers — typically the most capable and best-resourced criminal groups — extract maximum value quickly. They run credential-stuffing attacks, drain financial accounts, and sell any access they establish. Then they pass the remaining records downstream. Second-tier buyers pay less for data that’s been partly picked over. From there it migrates further: to public paste sites (Pastebin, various Ghostbin successors) and to free file hosts. Eventually it lands in aggregated “combo lists” that bundle records from dozens of separate breaches into single files, sold in batches of hundreds of millions.

The Adobe breach from October 2013 exposed 153 million records. It included email addresses, poorly encrypted passwords, and password hints stored as plain text. That data is still appearing as a component of credential combo lists over a decade later. The individuals whose passwords were reused across other accounts have continued providing value to attackers for twelve years. This is why breach exposure is not time-bounded by the breach date. Once a credential appears in a combo list, it will be tested and re-tested for years. Changing your password on the specific breached service helps. If the same password was used anywhere else, those accounts remain at risk indefinitely until each one is updated.

Stealer log markets — the real-time layer

Separate from static breach databases, stealer log markets operate on a different model: near-real-time sale of outputs from infostealer malware actively running on compromised devices.

Russian Market, 2easy.shop, and STYX Market are among the active examples. Genesis Market, before its takedown, was the most technically sophisticated. These markets sell “logs,” which are automated exports from malware installed on a victim’s machine. The malware usually arrives through a malicious download, pirated software, or a phishing email. A single log contains a lot: every password saved in the victim’s browsers, all active session cookies (enabling session hijacking without the password), form autofill data including addresses and payment card numbers, and device fingerprints including browser configuration, installed extensions, and timezone.

The value is immediacy. These aren’t credentials from a three-year-old breach. They’re credentials the victim used last Tuesday, with active session cookies that may still be valid. NordVPN’s research published in 2023 found over 54 million stolen credentials on dark web markets across a 12-month window. Of those, 26 million came from stealer malware logs rather than traditional database breaches. The distinction has practical consequences. Breach notification services like Have I Been Pwned index known breach databases. Stealer log markets operate outside that visibility. You won’t receive a breach alert for data stolen from your browser by malware on your own machine.

Law enforcement action and its structural limits

The pace of law enforcement action against criminal data markets has genuinely accelerated since 2022. The record is substantial: RaidForums seized April 2022. Genesis Market seized April 2023 in Europol’s Operation Cookie Monster, with 119 arrested across seventeen countries. BreachForums seized March 2023, its administrator ShinyHunters arrested. AlphaBay taken down in 2017 — at the time the largest dark web market — in a joint FBI, DEA, and Dutch National Police operation. Hansa Market taken down in the same 2017 operation.

These are meaningful disruptions. They are not permanent solutions. Forum administrators migrate to new infrastructure. Communities rebuild around new domains. BreachForums was seized in March 2023, relaunched within weeks under new administration, and the relaunch was seized again in May 2024. The underlying criminal economy generating the data — ransomware operations, infostealer malware campaigns, insider data theft — continues regardless of what happens to any particular marketplace.

More fundamentally: the data sold before a forum’s takedown remains in the possession of everyone who bought it. Law enforcement shutting down the marketplace does not erase the copies already distributed. The Facebook dataset from 2021 was circulating on RaidForums when the FBI seized it. The seizure didn’t delete the copies in buyers’ hands. The data has appeared on BreachForums, on Telegram channels, on file hosts, and continues to be used in SIM-swapping attacks and account takeover fraud years later.

What can you do about it?

None of this is abstract risk. Your credentials may already be in circulation. The question is whether you know, and whether you’ve limited the damage.

Check your breach exposure. Have I Been Pwned (haveibeenpwned.com) indexes breach databases and alerts you when your email address appears in a new one. Sign up for alerts for every email address you use. This doesn’t cover stealer log markets, but it covers the major public breach databases and catches most large incidents.

Use a password manager with unique passwords everywhere. This is the single most effective mitigation against credential stuffing. If every account has a different password, a breach of one account doesn’t give attackers access to others. The value of a stolen credential collapses to just that one site rather than everything you’ve ever signed up for.

Enable transaction alerts on all financial accounts. Credit card fraud from freshly stolen card data typically begins within 48 to 72 hours of the data appearing on a market. Real-time transaction alerts let you identify and dispute fraudulent charges before they compound.

Monitor your credit reports for new account openings. In the UK, check your reports through Experian, Equifax, and TransUnion — all three, because they don’t always match. In the US: annualcreditreport.com gives you free weekly reports from all three bureaus. A credit freeze — not a fraud alert, but an actual freeze — prevents new credit accounts being opened in your name without your active unfreeze step. It is free in both the UK (through each bureau directly) and the US (federally mandated free freeze since 2018).

Consider a dark web monitoring service that covers stealer log markets specifically. Most consumer identity monitoring services scan breach notification databases. Fewer cover the stealer log markets where real-time credential theft shows up first. Look for services that explicitly state stealer log coverage before subscribing.

The criminal economy that handles stolen data is efficient precisely because it is decentralised, competitive, and self-correcting. Individual market takedowns disrupt it; they don’t stop it. The practical response is to reduce what you stand to lose when, not if, your data appears somewhere in this pipeline.

Frequently asked questions

How much does stolen data sell for? Email and password pairs go for cents in bulk. Credit cards with CVV fetch $5–35, “fullz” identity packages $15–40, and medical records $20–100. Corporate network access can reach $25,000 or more.

How long does breach data stay usable? Years. The 2013 Adobe breach still appears in credential combo lists over a decade later. Once a password is in circulation, attackers test it repeatedly. Any account reusing it stays at risk until you change it.

Does a market takedown delete my data? No. Seizing a forum stops that platform, but it doesn’t erase copies already sold. The data reappears on successor forums, Telegram channels, and file hosts, and stays in use for years.

What are stealer logs? They’re real-time exports from malware on a victim’s device: saved passwords, active session cookies, and autofill data. Breach checkers like Have I Been Pwned index poorly, so you may get no alert. This is also how data ends up feeding people-search sites.

What you can do right now

Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these listings automatically. Join the waitlist to get in early.