(Credit: PCMag/Zain bin Awais/Weiquan Lin/via Getty Images)
Data breaches happen every day—and they're rarely random. Most stem from deliberate, targeted cyberattacks or the exploitation of overlooked security flaws, allowing criminals to infiltrate systems and steal sensitive information. This can include anything from email addresses and passwords to Social Security numbers, credit card details, medical records, or internal corporate documents.
It sounds alarming (and it is), but what really happens after your data is compromised? Where does it go once it’s been swept up in a breach? Understanding this process isn't just eye-opening—it's a critical step in knowing how to protect yourself in an increasingly data-driven world.
Where Does Your Data Go After a Breach?
Once your data is compromised in a breach, it turns into a commodity—something to be bought, sold, or traded. It might be sold on its own, but more often it's bundled with other stolen information as part of a larger dataset. The hackers or attackers responsible for the breach typically aren’t the ones who end up using your data. Think of it like a luxury jewelry store robbery: The thieves aren’t stealing the items to wear them—they’re after the profit they can make by selling them to others. Similarly, your data is just a valuable asset in an underground marketplace.
Information is only valuable so long as it is new and usable, so it is often sold off as quickly as possible. Where can you find it? Let's review the most likely destinations:
- The Dark Web: Many marketplaces for user data exist on the dark web since it isn’t regulated or moderated like the surface web. Attackers use non-indexed dark websites to turn data into profit without worrying about a web host or platform owner turning over their data to law enforcement. Credit cards, logins, Social Security numbers, passports, and any other kind of identifying information you can think of are bought, traded, and sold here.
- Secure Messaging Apps: Encrypted messaging services such as Signal and Telegram are excellent tools for anonymity and privacy. While such apps are invaluable for journalists and help users control their information, some criminal groups use these platforms to make chats deal in user data.
- Invite-Only Forums/Chats: The surface web has its fair share of forums, chat rooms, apps, and sites that publicly deal in stolen data. These resources are usually heavily moderated and kept under a strict invite-only system to limit the risk of being discovered by law enforcement.
- Publicly: Some breaches are made public without any direct sale of data. Government or company whistleblowers have taken this approach to spread the information as far as possible. Similarly, certain hackers have moral or ethical reasons for attacks, such as the Ashley Madison breach in 2015, which released the identities of all users due to the site being a hub for adulterous relationships.
- Privately: The most careful hackers deal internally with other malicious groups and secure private clients for user data, company secrets, and other leaked information.
Much like a regular marketplace for goods and services, prices shift based on supply and demand. If you are interested in the rough price that information sells for in various marketplaces, PrivacyAffairs conducts a detailed analysis every three years of how much user data is going for on the dark web.
What Information Do Cybercriminals Buy and Sell?
Dark web markets are as varied as a weekend farmer’s market. There are sites and hubs for, essentially, all forms of identifying information. From email accounts to social security numbers, a little bit of everything is available for the right price. Below are the three most common categories of sold data with short rundowns detailing how each kind is used:
- Payment Cards: Also known as “carding,” criminals will buy up bundles of leaked card details in the hopes of making fraudulent purchases.
- Site Credentials: Social media accounts and email profiles can be the subject of an attack to post defamatory content. More often, hackers steal these accounts to conduct further social engineering or phishing attacks on unsuspecting individuals.
- Personal Documents: Passports, social security numbers, and birth certificates are just a few of the more sensitive documents that criminals pay for with the aim of identity theft.
Other categories include crypto wallets, streaming service logins, verified PayPal accounts, and medical information.
What Can You Do to Protect Your Data?
It is difficult, if not impossible, to remove every trace of your personal information online. However, there are steps you can take that will make you far less vulnerable to attacks. A good password manager is an easy first step that will ensure you are protected in the event of a breach. A VPN can lock down your traffic and prevent your internet service provider (ISP) or any third-party advertisers from building a profile on you.
Adjust your privacy settings on social media accounts to prevent unrecognized accounts from scouring your pages. It is also worth removing identifying information from your posts and account, such as your place of work, address, and relationship status. Simply limiting what you share can make it much more difficult for a hacker to target you or get up-to-date information that can be used against you.
Similarly, be aware of what information you are giving a website when you sign up for an account or make a purchase. When in doubt, it is worth using one-time payment methods, burner emails, and a P.O. Box to keep your true identity confidential.
If you are subject to a data breach, make sure to monitor related accounts. If a site you’ve made a purchase from has had payment data leaked, then it may be necessary to lock down your payment cards and to notify your bank. In the event of stolen sensitive information, you might need to freeze your credit. Monitoring news stories and keeping track of events isn’t always feasible. Data removal services can do the hard work for you while also monitoring the dark web for leaks with your information in them.
Regardless of which tools you use, take a proactive approach to privacy. Otherwise, you may find yourself doing damage control while a cybercriminal wreaks havoc with your stolen data.