The BigBasket breach happened in October 2020. Twenty million user records — names, email addresses, dates of birth, locations, hashed passwords — were exfiltrated from the grocery platform’s database. Within 72 hours, those records were listed for sale on a dark web forum for $40,000. By the end of that week, they had a buyer.
Most BigBasket users found out months later, when it made the news. Their data had already moved three times.
This is what actually happens after a breach. Not the press release, not the “we take your security seriously” email. The actual path your data takes, step by step.
The short answer: After a breach, your data enters a dark web market within 24 to 72 hours. It’s sold, resold, and enriched by combining it with other breaches, people-search sites, and social profiles. Prices range from cents for an email:password pair to $1,000 for medical records. Criminals use it for credential stuffing, targeted phishing, account takeover, and new-account fraud. Crucially, stolen data never expires while the password still works, so old breaches keep causing damage. Change reused passwords and enable app-based two-factor authentication.
What happens in the first 24 hours after a breach?
Breach data moves fast. In most cases, exfiltrated records appear on dark web forums within 24 to 72 hours of being stolen — sometimes faster if the attacker has existing relationships with buyers.
The attacker has two options. The first is an exclusive first sale: list the data on a private, invitation-only forum at a premium. It goes to the highest bidder, usually criminal groups who want fresh, unworked credentials nobody else has tried yet. The second option is to use the data themselves first. They run credential stuffing against every major platform, drain whatever they can, then sell the residual dataset.
Either way, your data has entered a market within days of the breach. The company whose database was hit often doesn’t know yet.
The dark web market structure
There isn’t one dark web. There’s an ecosystem — layered by access level, trust, and data freshness.
Private forums sit at the top: invitation-only, high trust, high prices. BreachForums was the largest English-language breach forum until its administrator was arrested and the FBI seized the site in 2023. Its successors (and there are several — this market is resilient) operate the same way. Fresh data — records from breaches in the past thirty days — commands the highest prices here.
Public marketplaces are a tier below. Broader access, older data, lower prices. Think of it as the secondary market for breach records that have already been sold once at full price.
Telegram channels have grown significantly since the BreachForums takedowns — faster to set up, harder to trace, with no hosting infrastructure to seize. A lot of mid-tier breach trading now happens across private Telegram groups.
Paste sites (Pastebin and its successors) are free data dumps — usually aged, often partial. If your data ends up here, it’s been through multiple owners already.
What does your data sell for?
Prices vary by freshness, jurisdiction, and what the record contains.
A bare email and password combination sells for $0.05 to $2.00. A dump of 20 million records at $0.10 each is $2 million — volume compensates for the low per-record price.
Name, address, and date of birth runs $0.50 to $5.00. Add a Social Security Number and that jumps to $10 to $150 depending on credit history indicators.
Financial account credentials — online banking login with verified balance — sell for $20 to $200. An account holding $50,000 sells for more than one with $500.
Full KYC packages (identity document scan, selfie, name, address, date of birth) sell for $50 to $300. They’re ready to use for opening fraudulent bank or crypto accounts. Indian Aadhaar-plus-PAN packages trade at the lower end globally due to volume, but verified selfie matches command a premium.
Medical records fetch $250 to $1,000 each — rarest and most valuable, usable for insurance fraud, prescription fraud, and blackmail.
How does enrichment combine your data?
Here’s what most people don’t account for: buyers don’t use breach data in isolation.
After purchasing your record from the BigBasket breach (your name, email, hashed password), a sophisticated buyer runs enrichment. They cross-reference your email against other breach databases and look you up on people-search sites to append your home address and phone number. They also check LinkedIn for your employer and add your bank if a financial breach exposed it.
Your email address from BigBasket was worth $0.10. Now add your home address, employer, bank, and a working password from a 2019 breach you’d forgotten about. That profile is worth $50, and it took the buyer fifteen minutes to build.
Your 2020 BigBasket record gets enriched with your 2020 Drizly record and your 2023 MOVEit record. Each addition increases the profile’s criminal utility. The breaches compound.
The criminal uses — roughly in order of immediacy
Credential stuffing runs within hours of a fresh dump going public. Automated tools test leaked username-and-password pairs against Gmail, banking apps, Amazon, PayPal — anything high-value. People reuse passwords. One operator can test millions of pairs across dozens of platforms in an afternoon.
Targeted phishing follows for records where the password didn’t work. Your name, email, and personal details become raw material for spear phishing emails that know your real bank and employer. The enrichment step is what makes these convincing.
Account takeover targets email first — it resets every other password. Once an attacker has your inbox, they’re into your banking, investment accounts, and crypto exchange. SMS two-factor authentication doesn’t help if they also execute a SIM swap using identity data from the same breach.
New account fraud uses KYC packages to open bank accounts and credit cards in your name, for money laundering or credit fraud. You find out when a collections agency calls.
Then — months or years later — your record surfaces in a new combolist and the cycle runs again.
Why do old breaches keep causing damage?
This is the part that’s genuinely underappreciated: stolen data doesn’t depreciate the same way stolen goods do.
A stolen car gets used once and then it’s traceable. Stolen data gets copied, sold, resold, enriched, and put back into circulation indefinitely. The 2012 LinkedIn breach — 117 million records — was still appearing in new credential-stuffing attacks in 2020. An eight-year-old database, still causing active account takeovers.
Why? Because most people never changed the passwords exposed in that 2012 breach. The credentials stayed valid. Stolen data never expires if the victim doesn’t act. Your 2016 email-and-password combination is still live credentials if you’re still using that password.
This is the specific reason checking Have I Been Pwned for old breaches matters — not just recent ones. A breach you forgot about five years ago, where you never changed your password, is still an active attack vector right now. That same password, if you reused it anywhere, unlocks every account where you did.
The data doesn’t age out. It waits.
Frequently asked questions
How fast does breached data reach the dark web? Usually within 24 to 72 hours of being stolen, sometimes faster if the attacker already has buyers. By the time you get a notification, your data has often moved through several hands.
What does stolen data sell for? From $0.05–$2 for an email:password pair, to $10–$150 for an identity with a Social Security Number, to $250–$1,000 for medical records. Fresh data commands the highest prices.
Why do old breaches still cause harm? Because stolen data doesn’t expire while the password still works. The 2012 LinkedIn breach was still fuelling account takeovers in 2020. Any reused, unchanged password remains a live attack vector.
How do I protect myself? Use a unique password on every account, enable app-based two-factor authentication, and check Have I Been Pwned for old breaches too. Removing yourself from people-search sites breaks the enrichment step attackers rely on.
What you can do right now
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist to get in early.