How much can your stolen account information sell for on the online black market?

[[152242]]

According to US media reports, Intel Security Group today released the "Hidden Data Economy" report, which describes how stolen data is classified and sold at a price.

The company's McAfee Labs examined the prices of stolen credit and debit card data, bank account login credentials, underground money transfer services, online payment service login credentials, premium content service login credentials, corporate network login credentials, hotel membership account login credentials and online auction account login credentials.

McAfee Labs has worked with IT security vendors, law enforcement agencies, and others over the past few years to identify and evaluate a wide range of websites, chat rooms, and other online platforms, communities, and marketplaces that sell and buy stolen data. Using this experience, researchers are now able to comprehensively assess the "state of the cybercriminal economy" and describe the types and prices of key data.

Payment Cards

Payment card data is perhaps the most well-known type of data that is stolen and sold. McAfee Labs researchers found that data is packaged, priced, and sold in different categories on the black market. Basic data includes valid numbers generated by software, such as primary account number (PAN), expiration date, and CVV2 number. Valid credit card number generators can also be purchased online. If additional information is required, such as bank account ID numbers, birthdays and billing addresses, PIN numbers, social security numbers, etc., the price will increase.

The following chart shows the price of credit and debit card account information by region:.

Payment service account

Online payment accounts appear to be priced based on account balance, likely due to limited account usage. Login certificates for accounts with balances between $400-1000 are estimated to cost $20-50, while accounts with balances between $5000-8000 are priced at $200-300.

Bank Login Certificate

Cybercriminals can buy bank login certificates and services that allow them to secretly transfer stolen funds across borders. McAfee Labs found that a login certificate for an account with a balance of $2,200 was sold for $190, and if a bank login certificate was packaged with the ability to secretly transfer funds to a U.S. bank, the price for an account with a balance of $6,000-20,000 was $500-1,200. For a transfer to the United Kingdom, an account with a balance of $10,000-16,000 was sold for $700-900.

Online paid content services

The report also estimates that the black market prices for account login credentials for online content services are $0.55-1 for online video, $7.5 for paid cable TV services, $0.55 for paid comic book services, and $15 for professional sports channels. These relatively low prices suggest that cybercriminals have stepped up their automated theft operations to make their criminal business model profitable.

Membership and community accounts

Some online services, such as hotel membership login credentials and online auction site accounts, seem to be low-value targets, but researchers found that these credentials are also sold on the black market. McAfee Labs found that membership accounts of major hotel brands with 100,000 points were sold for $20, and accounts of highly reputable online auction communities were sold for $1,400.